Merge pull request #1974 from GoogleContainerTools/test_new_rules_oci

refactor: support latest rules_oci

Author: loosebazooka

.bazelrc

@@ -2,16 +2,17 @@
 # Take care to document any settings that you expect users to apply.
 # Settings that apply only to CI are in .github/workflows/ci.bazelrc
 
-# Allow DOCKER_HOST env to leak into test actions. 
+# Allow DOCKER_HOST env to leak into test actions.
 test --test_env=DOCKER_HOST
 
-# Stamp 
+# Stamp
 build:release --workspace_status_command=./private/stamp.bash --stamp
 run:release --workspace_status_command=./private/stamp.bash --stamp
 test:release --workspace_status_command=./private/stamp.bash --stamp
 
 # Allow external dependencies to be retried. debian snapshot is unreliable and needs retries.
 common --experimental_repository_downloader_retries=20
+common --experimental_downloader_config=downloader.cfg
 common --http_timeout_scaling=2.0
 
 # Enable platform specific options

.github/workflows/ci.yaml

@@ -33,18 +33,10 @@ jobs:
           restore-keys: |
             bazel-cache-deps-ci1-${{ github.sha }}
             bazel-cache-deps-ci1-
-      - name: Free space
-        run: |
-          sudo apt-get remove -y '^dotnet-.*'
-          sudo apt-get remove -y '^llvm-.*'
-          sudo apt-get remove -y 'php.*'
-          sudo apt-get remove -y azure-cli google-cloud-cli google-chrome-stable firefox powershell mono-devel
-          sudo apt-get autoremove -y
-          sudo apt-get clean
-          rm -rf /usr/share/dotnet/
+
       - name: Fetch # this can take a long time if there are a lot of errors
         run: |
-          for i in $(seq 10); do 
+          for i in $(seq 10); do
             bazel --bazelrc=$GITHUB_WORKSPACE/.github/workflows/ci.bazelrc fetch //... && break || sleep 180;
           done
       - name: Build All Images
@@ -71,19 +63,10 @@ jobs:
           restore-keys: |
             bazel-cache-deps-ci2-${{ github.sha }}
             bazel-cache-deps-ci2-
-      - name: Free space
-        run: |
-          sudo apt-get remove -y '^dotnet-.*'
-          sudo apt-get remove -y '^llvm-.*'
-          sudo apt-get remove -y 'php.*'
-          sudo apt-get remove -y azure-cli google-cloud-cli google-chrome-stable firefox powershell mono-devel
-          sudo apt-get autoremove -y
-          sudo apt-get clean
-          rm -rf /usr/share/dotnet/
 
       - name: Fetch
         run: |
-          for i in $(seq 20); do 
+          for i in $(seq 20); do
             bazel --bazelrc=$GITHUB_WORKSPACE/.github/workflows/ci.bazelrc cquery 'attr(tags, "amd64", ...)' && break
             sleep 10;
           done

CONTRIBUTING.md

@@ -20,9 +20,9 @@ Follow either of the two links above to access the appropriate CLA and instructi
 3. For building and loading images to your local Docker engine, you need to add a new rule for that image to the BUILD:
 
 ```starlark
-load("@rules_oci//oci:defs.bzl", "oci_tarball")
+load("@rules_oci//oci:defs.bzl", "oci_load")
 
-oci_tarball(
+oci_load(
   name = "local_build",
   image = "//base:static_root_amd64_debian17",
   repo_tags = [],

MODULE.bazel

@@ -4,20 +4,21 @@ module(name = "distroless")
 
 bazel_dep(name = "bazel_skylib", version = "1.8.1")
 bazel_dep(name = "aspect_bazel_lib", version = "2.21.1")
+bazel_dep(name = "rules_pkg", version = "1.1.0")
 bazel_dep(name = "platforms", version = "1.0.0")
 bazel_dep(name = "rules_go", version = "0.57.0")
 bazel_dep(name = "gazelle", version = "0.38.0")
-bazel_dep(name = "rules_pkg", version = "1.1.0")
 bazel_dep(name = "rules_rust", version = "0.63.0")
 bazel_dep(name = "container_structure_test", version = "1.19.1")
-bazel_dep(name = "rules_oci", version = "1.8.0")
-bazel_dep(name = "rules_distroless", version = "0.5.3")
+bazel_dep(name = "rules_oci", version = "2.2.7")
+bazel_dep(name = "rules_distroless", version = "0.6.2")
 bazel_dep(name = "rules_python", version = "1.5.3")
 bazel_dep(name = "rules_cc", version = "0.2.0")
 
 ### OCI ###
+# Note: rules_oci registers toolchains in its MODULE.bazel
+# We import the repos to use crane in sign_and_push rule
 oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
-oci.toolchains(crane_version = "v0.18.0")
 use_repo(oci, "oci_crane_toolchains")
 
 ### PYTHON ###

MODULE.bazel.lock

@@ -1,10 +1,8 @@
 "defines a function to replicate the container images for different distributions"
 
 load("@container_structure_test//:defs.bzl", "container_structure_test")
-load("@rules_go//go:def.bzl", "go_binary")
 load("@rules_oci//oci:defs.bzl", "oci_image", "oci_image_index")
-load("@rules_pkg//:pkg.bzl", "pkg_tar")
-load("//common:variables.bzl", "DEBUG_MODE", "NONROOT", "USERS")
+load("//common:variables.bzl", "DEBUG_MODE", "USERS")
 load("//private/util:deb.bzl", "deb")
 
 def base_nossl_image_index(distro, architectures):

base/base.bzl

@@ -18,7 +18,7 @@ tar(
         "gnutar",
     ],
     compress = "gzip",
-    mtree = ["./ type=dir uid=0 gid=0 time=0.0"],
+    mtree = ["./ type=dir uid=0 gid=0 mode=0755 time=0.0"],
 )
 
 tar(

common/BUILD.bazel

@@ -0,0 +1,2 @@
+rewrite (mirrors\.kernel\.org)/gnu/(.*) https://ftp.gnu.org/gnu/$2
+rewrite (mirrors\.kernel\.org)/gnu/(.*) https://ftpmirror.gnu.org/gnu/$2

downloader.cfg

@@ -1,7 +1,7 @@
 # Public notice: this file is for internal documentation, testing, and
 # reference only. Note that repo maintainers can freely change any part of the
 # repository code at any time.
-load("@rules_oci//oci:defs.bzl", "oci_tarball")
+load("@rules_oci//oci:defs.bzl", "oci_load")
 load("//private/oci:defs.bzl", "go_image")
 
 package(default_visibility = ["//visibility:public"])
@@ -13,10 +13,9 @@ go_image(
 )
 
 # Run
-# bazel build //examples/go:tarball
-# podman load -i bazel-bin/examples/go/tarball/tarball.tar
+# bazel run //examples/go:tarball
 # podman run localhost/distroless/examples/go:latest
-oci_tarball(
+oci_load(
     name = "tarball",
     image = ":go_example",
     repo_tags = ["distroless/examples/go:latest"],

examples/go/BUILD

@@ -3,7 +3,7 @@
 # repository code at any time.
 load("@container_structure_test//:defs.bzl", "container_structure_test")
 load("@rules_oci//oci:defs.bzl", "oci_image")
-load("@rules_pkg//:pkg.bzl", "pkg_tar")
+load("//private/util:tar.bzl", "tar")
 
 package(default_visibility = ["//visibility:public"])
 
@@ -20,14 +20,14 @@ DISTROS = [
 # These examples are adapted from:
 # https://howtonode.org/hello-node
 
-pkg_tar(
+tar(
     name = "hello_tar",
     srcs = [
         "hello.js",
     ],
 )
 
-pkg_tar(
+tar(
     name = "hello_http_tar",
     srcs = [
         "hello_http.js",