There were some bugs here before:
- for indexes, we'd annotate the base, but then append to empty.Index
which didn't carry those forward.
- when producing single-platform images based on multi-platform indexes
(the default and most common scenario), we wouldn't carry forward the
original base index's annotations to the single matching platform base
image.
* Produce OCI images by default
This changes build logic to prefer to produce OCI images and indexes,
even if original base images are Docker manifests or manifest lists.
OCI indexes support annotations, while Docker manifest lists do not, and
we'd like to inject base image information in annotations wherever possible.
Since Quay.io recently added support for OCI manifests, this is no
longer a serious breaking change -- and anyway, producing SBOMs by default
already breaks Quay.io without --sbom=none.
This behavior can be disabled with --preserve-docker-media-type=true,
which will result in Docker-type manifests being produced if and only if
the base image was a Docker-typed manifest.
This partially reverts commit 42723d75e7.
* drop e2e test
* update generated docs
* --preserve-media-type
* docs
* Generate CycloneDX SBOMs using our own JSON generation
* fix some errors
* Add support to ko deps
* Add e2e SBOM validation
* ignore empty hashes (why are hashes empty?)
This adds implicit support for Google, Amazon, Azure and GitHub
container registries if the environment provides credentials.
Binary size increases from 22 MB -> 26 MB
* Support partial platform matching for osversion only
* Add doc comment
* lint fixes
* pick up Platform.String and v1.ParsePlatform
* go mod tidy && go mod vendor
* Support osversion when selecting base images
Use this in e2e tests.
Also clean up usage of bo.Platform vs a new platform var.
* use correct osversion
* Prepare for Go 1.18 by replacing all our forked code
This hides our forked-from-gotip code behind a build tag so it's only
used when the build is run on Go <1.18. For builds >= 1.18, we'll use
the actual runtime/debug and debug/buildinfo packages.
Add preliminary support for building on Go 1.18beta1 to our Build
matrix, to ensure this code builds. It's all a terrible hack, but it'll
get less so when 1.18 is actually released.
* Fix lint and boilerplate
* Add .ko.yaml to base ko container image on golang:1.17
Ignore this in e2e tests, since even though golang:1.17 provides a
Windows base image, ko's base image platform selection doesn't take
osversion into account. The e2e tests don't exercise golang usage at
all, so it shouldn't matter.
* Update README
* Add a workflow to push a :latest ko image to ghcr.io
This also tags images with the commit SHA
* Update .github/workflows/image.yaml
Co-authored-by: jonjohnsonjr <jonjohnson@google.com>
* Update .github/workflows/image.yaml
Co-authored-by: jonjohnsonjr <jonjohnson@google.com>
* Update .github/workflows/image.yaml
Co-authored-by: jonjohnsonjr <jonjohnson@google.com>
Co-authored-by: jonjohnsonjr <jonjohnson@google.com>
* WIP: generate ko deps in SPDX format
- copy out a bunch of BuildInfo stuff that will land in 1.18
* review comments
* have deps take --sbom flag more like Matt's new publish-time flag
* Generate Markdown docs
This is largely copied from similar work in go-containerregistry
This required moving the Root command definition out of main() into a
place where it could be referenced from the gendoc tooling.
* fix boilerplate
* moar fix boilerplate
* update cmd/ko/main.go
* set -j to GOMAXPROCS at runtime
* rebase on cli-runtime change
* remove trailing whitespace
* Don't set image.base.name if base is specified by digest
* don't set empty annotation
* annotate Results, not Images and Indexes separately
* moar cleanup
* skip annotations check for images in indexes, these won't be annotated anymore
* first pass: kubectl flags must be passed after '--'
* add warning when using non-separated flags
* mark flags as deprecated
* drop defaultCacheDir and homedir dependency
* Implement ko deps
* actually add deps.go
* specify auth, useragent, platform
* stop reading tar if the context is cancelled
* chmod to the file's perms
* remove support for --platform, modules don't care about build tags
* fix copyright boilerplate
* drop fs dependency
* udpate module integration test to newer Go versions
* use entrypoint to identify the binary
* fix gosec finding, some style comments
* revert modules integration test change
* Build working Windows container images
Add e2e tests that run on Windows and cover kodata behavior
* now successfully skipping symlinks on windows :-/
* fix e2e test on windows, that relied on a symlink in kodata after all
* document windows symlink issue
* review feedback
* re-add kodata symlink tests for linux
Also:
- collect and upload logs as build artifacts
- don't bother testing many k8s versions
- don't checkout and install into GOPATH
- install ko from ./ to avoid warning
- remove unnecessary knative cruft
Jason Hall
