This includes a number of template parameters supported by [goreleaser](https://goreleaser.com/customization/templates/). Specifically, the build date information and the majority of the Git params.
Majority of the code is copied from goreleaser. I've added the MIT license from goreleaser at the top of the files.
Fixes#493
Signed-off-by: Nathan Mittler <nmittler@aviatrix.com>
Supports configuring global `env` variables that will be applied to all builds.
Modifies the `builder` function to accept a `buildContext` structure. This will simplify similar modifications in the future.
Fixes#1305
Signed-off-by: Nathan Mittler <nmittler@aviatrix.com>
This plumbs through support for building multi-arch SPDX SBOMs largely based on Puerco's outline, but with a few
adaptations. I added a few minor refactorings to try to enable consistency across the Image/Index SBOMs.
Related: https://github.com/google/ko/issues/655
There were some bugs here before:
- for indexes, we'd annotate the base, but then append to empty.Index
which didn't carry those forward.
- when producing single-platform images based on multi-platform indexes
(the default and most common scenario), we wouldn't carry forward the
original base index's annotations to the single matching platform base
image.
* Produce OCI images by default
This changes build logic to prefer to produce OCI images and indexes,
even if original base images are Docker manifests or manifest lists.
OCI indexes support annotations, while Docker manifest lists do not, and
we'd like to inject base image information in annotations wherever possible.
Since Quay.io recently added support for OCI manifests, this is no
longer a serious breaking change -- and anyway, producing SBOMs by default
already breaks Quay.io without --sbom=none.
This behavior can be disabled with --preserve-docker-media-type=true,
which will result in Docker-type manifests being produced if and only if
the base image was a Docker-typed manifest.
This partially reverts commit 42723d75e7.
* drop e2e test
* update generated docs
* --preserve-media-type
* docs
* Support partial platform matching for osversion only
* Add doc comment
* lint fixes
* pick up Platform.String and v1.ParsePlatform
* go mod tidy && go mod vendor
* Pre-parse platform string with StringSliceVar
This allows users to declare --platform multiple times and have the
values appended, i.e.:
ko build --platform=linux/amd64 --platform=linux/arm64
is equivalent to
ko build --platform=linux/amd64,linux/arm64
As a side effect, platformMatcher.spec and gobuildOpener.platforms are
now of type []string (instead of string) to maintain structure of
information from flag parsing.
* Adjust comments and styling for clarity.
* The flag --platform is now of type strings.
Internally cobra/pflag defines StringSliceVar as "strings" whereas
StringVar is defined as "string".
This change is updated by running hack/update-codegen.sh script.
* Add backwards compatibility for WithPlatforms function signature
Update comments to reflect implementation as well.
* Fix syntax failure on unit test
* Connect SBOMs with SPDX support.
This combines Jason's SPDX stuff and my SBOM stuff to support
SPDX-based SBOMs by default instead of our `go version -m`
invention.
* Make ko deps use SPDX by default
This adds functionality that enables the default publisher to
publish SBOMs (and later signatures and attestations) when the
`build.Result` is an `oci.SignedEntity`.
This also changes the `gobuild` logic to start producing
`oci.Signed*` as its `build.Result`s, so when executed we get an
SBOM for each architecture image.
For example, see the "Published SBOM" lines below:
```shell
2021/11/19 19:24:50 Using base gcr.io/distroless/static:nonroot for github.com/google/ko
2021/11/19 19:24:51 Building github.com/google/ko for linux/amd64
2021/11/19 19:24:52 Building github.com/google/ko for linux/arm64
2021/11/19 19:24:57 Publishing ghcr.io/mattmoor/ko:latest
2021/11/19 19:24:58 existing blob: sha256:c78c74e7bb4a511f7d31061fbf140d55d5549a62d33cdbdf0c57ffe43603bbeb
2021/11/19 19:24:58 existing blob: sha256:4aa59d0bf53d4190174fbbfa3e9b15fdab72e5a95077025abfa8435ccafa2920
2021/11/19 19:24:58 ghcr.io/mattmoor/ko:sha256-d2bc030f5ed083d5e6a30a7969c9a8e599511b8d7a6e20695bf5ea029b6e2c3f.sbom: digest: sha256:c67ec671aaa82902e619883a7ac7486e6f9af36653449e2eb030ba273fe5a022 size: 348
2021/11/19 19:24:58 Published SBOM ghcr.io/mattmoor/ko:sha256-d2bc030f5ed083d5e6a30a7969c9a8e599511b8d7a6e20695bf5ea029b6e2c3f.sbom
2021/11/19 19:24:58 existing blob: sha256:c78c74e7bb4a511f7d31061fbf140d55d5549a62d33cdbdf0c57ffe43603bbeb
2021/11/19 19:24:58 existing blob: sha256:4aa59d0bf53d4190174fbbfa3e9b15fdab72e5a95077025abfa8435ccafa2920
2021/11/19 19:24:59 ghcr.io/mattmoor/ko:sha256-b74c230f20efd94981e5fd823bacc23cbd71055a1b3b6a0893152b398c67743b.sbom: digest: sha256:c67ec671aaa82902e619883a7ac7486e6f9af36653449e2eb030ba273fe5a022 size: 348
2021/11/19 19:24:59 Published SBOM ghcr.io/mattmoor/ko:sha256-b74c230f20efd94981e5fd823bacc23cbd71055a1b3b6a0893152b398c67743b.sbom
2021/11/19 19:24:59 existing blob: sha256:3f7e3c6765a6abc682cd40ea256fbea5c1d4debbc07659efbc0dedc13eee0da6
2021/11/19 19:24:59 existing blob: sha256:250c06f7c38e52dc77e5c7586c3e40280dc7ff9bb9007c396e06d96736cf8542
2021/11/19 19:24:59 existing blob: sha256:e8614d09b7bebabd9d8a450f44e88a8807c98a438a2ddd63146865286b132d1b
2021/11/19 19:24:59 existing blob: sha256:7067b1bc6f9ce59f3a4ed2216946ebbb27a4f7a102f55d96c6af1dc90e77b510
2021/11/19 19:25:00 ghcr.io/mattmoor/ko@sha256:d2bc030f5ed083d5e6a30a7969c9a8e599511b8d7a6e20695bf5ea029b6e2c3f: digest: sha256:d2bc030f5ed083d5e6a30a7969c9a8e599511b8d7a6e20695bf5ea029b6e2c3f size: 751
2021/11/19 19:25:01 existing blob: sha256:250c06f7c38e52dc77e5c7586c3e40280dc7ff9bb9007c396e06d96736cf8542
2021/11/19 19:25:02 pushed blob: sha256:121c637d5c84562b51404a6f71c1f995ad059740293a3911a0dc33eb223e41a4
2021/11/19 19:25:02 pushed blob: sha256:859e03b7461b2a512159493ef1504d2859ed37c05ed1ef781ff98394ea4799b5
2021/11/19 19:25:02 pushed blob: sha256:d1b55c3db0f16b5056776c6d2c279efd16d28dbf1aae3eef1f3f9b7551d1f490
2021/11/19 19:25:03 ghcr.io/mattmoor/ko@sha256:b74c230f20efd94981e5fd823bacc23cbd71055a1b3b6a0893152b398c67743b: digest: sha256:b74c230f20efd94981e5fd823bacc23cbd71055a1b3b6a0893152b398c67743b size: 751
2021/11/19 19:25:03 ghcr.io/mattmoor/ko:latest: digest: sha256:e4466a7dd9be66c7c1b43a8ecc19247041ece232407a14e3d6ea3c51d2561a71 size: 529
2021/11/19 19:25:03 Published ghcr.io/mattmoor/ko@sha256:e4466a7dd9be66c7c1b43a8ecc19247041ece232407a14e3d6ea3c51d2561a71
ghcr.io/mattmoor/ko@sha256:e4466a7dd9be66c7c1b43a8ecc19247041ece232407a14e3d6ea3c51d2561a71
```
The "SBOM" being attached in this change is the raw output of `go version -m`,
which we will convert to one of the standard formats in a subsequent change.
Enables programmatic control of whether `ko` adds the `-trimpath`
flag to `go build`.
The `-trimpath` flag removes file system paths from the resulting
binary. `ko` adds `-trimpath` by default as it aids in achieving
reproducible builds.
However, removing file system paths makes interactive debugging more
challenging, in particular in mapping source file locations in the
IDE to debug information in the binary.
If you set `Trimpath` to `false` to enable interactive debugging, you
probably also want to set `DisableOptimizations` to `true` to disable
compiler optimizations and inlining.
Reference for `-trimpath`:
https://pkg.go.dev/cmd/go#hdr-Compile_packages_and_dependenciesResolves: #500
Related: #71, #78, https://github.com/GoogleContainerTools/skaffold/issues/6843
* Use tools/go/packages in place of go/build
* Use build config dir
Signed-off-by: Ben Moss <benm@vmware.com>
* Use filepath.Dir in place of ".." for explicitness
* Don't set image.base.name if base is specified by digest
* don't set empty annotation
* annotate Results, not Images and Indexes separately
* moar cleanup
* skip annotations check for images in indexes, these won't be annotated anymore
* Build working Windows container images
Add e2e tests that run on Windows and cover kodata behavior
* now successfully skipping symlinks on windows :-/
* fix e2e test on windows, that relied on a symlink in kodata after all
* document windows symlink issue
* review feedback
* re-add kodata symlink tests for linux
There are use cases, where multiple Go build flags need to be set. However, the
environment variable to pass flags to Go build has some limits for `ldFlags`.
Add GoReleaser inspired configuration section to `.ko.yaml` to support setting
specific Go build and ldFlags to be used by the build. Like GoReleaser the
content of the configuration can use Go templates. Currently, only a section
for environment variables is included.
In order to reduce dependency overhead, only the respective config structs from
https://github.com/goreleaser/goreleaser/blob/master/pkg/config/config.go are
used internally to load from `.ko.yaml`.
This change adds a `WorkingDirectory` field to `options.BuildOptions`,
but doesn't expose this as a CLI flag. The default zero value means the
current working directory. The value is used as the directory for
executing `go` tool commands.
When embedding ko in other tools, it is sometimes necessary to set the
working directory for executing the `go` tool, instead of assuming the
current process working directory.
An example of where this is required from Skaffold:
https://github.com/GoogleContainerTools/skaffold/tree/master/examples/microservices
In this example, the working directory doesn't contain either `go.mod`
or any Go files. The `skaffold.yaml` configuration file specifies
a `context` field for each image, which is the directory where the `go`
tool can find package information.
* Move ko binary to root of project.
* go.mod says required golang version is 1.14
* go install uses the folder name
* lint and copyright bump
* moving the test file changed the test hash.
* more refs of cmd/test
* add deprecation message
* Allow comma-separated list of platforms
* Parse platform spec once
* Update --platform docs in README
* Update pkg/build/gobuild_test.go
Co-authored-by: Matt Moore <mattmoor@vmware.com>
* Return err for bad defaulting for --platform
Also respect GOARM as variant if the goarch is arm.
* Refactor platform matching
* Update README.md to mention GOARM
* Fix travis test
Co-authored-by: Matt Moore <mattmoor@vmware.com>
* Add ctx to publish.Interface
I noticed that hitting ctrl-C didn't work when pushing images, this
should fix that.
* Use context everywhere that makes sense
Thus if you have a (in)direct command package as a dependency
say `myhost.com/go/package/cmd/run` you can now publish this
with the following ko command
ko publish myhost.com/go/package/cmd/run
Fixes the PATH environment variable so it contains the directory
containing the binary (i.e., /ko-app) instead of the binary itself
(e.g., /ko-app/ko).
See #114.
Since we are always building linux containers, use `path.Join` rather than
`filepath.Join` when adding files to the tar.
Signed-off-by: Evan Anderson <evan.k.anderson@gmail.com>
