Enabling hermetic build for konflux onboarding#23
Conversation
beraldoleal
force-pushed
the
hermetic-build
branch
from
caacaa2 to
fae6632
Compare
littlejawa
left a comment
littlejawa
left a comment
There was a problem hiding this comment.
Looks nice. Can't wait to see what Konflux will do with it :-)
/lgtm
Thanks @beraldoleal !
|
Thanks for the commit... Just hold a bit, since I noticed some versions mismatch. I'm trying to fix. |
beraldoleal
force-pushed
the
hermetic-build
branch
from
fae6632 to
9293438
Compare
|
No mismatch, just fixing the portugues -> ingles. |
|
Hey @littlejawa , we might not use Konflux for the coco-tools builds in 1.13, but I'd still like to test the hermetic build in this release and include it in the release pipeline, even if we keep pushing the image to quay.io directly for now. I've updated the PR with the following changes: Component versions (all using stable releases now):
What changed:
Veritas is still on main for now. I'm working on a release for it and should have a tagged version shortly, just waiting on an open PR to land first. |
|
|
||
| ## Files | ||
|
|
||
| - **hermeto-input.json**: hermeto/cachi2 configuration for dependency prefetch |
There was a problem hiding this comment.
The hermeto configuration is part of the .tekton files you'll get when you will onboard this repo to Konflux.
You will not need this hermeto-input.json file, but you'll have to configure/update the pipeline files.
Add hermetic build support using cachi2/hermeto for dependency prefetch. Source dependencies are git submodules pointing to downstream (openshift/) repos. Submodules: - openshift/confidential-containers-guest-components (osc-release) - openshift/trustee (main) - openshift/kata-containers (osc-release) - virtee/snpguest (v0.10.0) - virtee/snphost (v0.7.0) - virtee/tdx-measure (v0.1.1) Build changes: - Rust from UBI10 RPMs (1.92.0) instead of rustup - RPM lockfile for reproducible builds - hermeto-input.json for cargo/pip dependency prefetch - Containerfile.ubi supports both local and hermetic modes
The original --no-default-features flag worked with trustee v0.17.0 which had no default features. The downstream trustee now defaults to default-tls, and kbs_protocol requires reqwest with TLS enabled. Dropping --no-default-features aligns with how openshift/trustee builds kbs-client (make cli-static-linux).
beraldoleal
force-pushed
the
hermetic-build
branch
from
58ed038 to
8410aa7
Compare
|
@littlejawa let me know if that works for you ^ |
2 participants
Vide individual commits for details.