Add builds for debian13 static, base, base-nossl

Also mention they are in preview in README
These builds include merged usrfs, so consumers
need to be aware that they
- must respect symlinks
- users of rules_distroless should enable mergedusr

Signed-off-by: Appu Goundan <appu@google.com>

Author: loosebazooka

BUILD

@@ -1,5 +1,5 @@
 load("//:checksums.bzl", "ARCHITECTURES", "BASE_ARCHITECTURES")
-load("//base:distro.bzl", "DISTROS")
+load("//base:distro.bzl", "DISTROS", "PREVIEW_DISTROS")
 load("//private/oci:defs.bzl", "sign_and_push_all")
 load("//nodejs:node_arch.bzl", "node_arch")
 
@@ -31,14 +31,14 @@ STATIC |= {
     "{REGISTRY}/{PROJECT_ID}/static-" + distro + ":" + tag_base + "-" + arch: "//base:" + label + "_" + user + "_" + arch + "_" + distro
     for arch in ARCHITECTURES
     for (tag_base, label, user) in STATIC_VARIANTS
-    for distro in DISTROS
+    for distro in DISTROS + PREVIEW_DISTROS
 }
 
 # oci_image_index
 STATIC |= {
     "{REGISTRY}/{PROJECT_ID}/static-" + distro + ":" + tag_base: "//base:" + label + "_" + user + "_" + distro
     for (tag_base, label, user) in STATIC_VARIANTS
-    for distro in DISTROS
+    for distro in DISTROS + PREVIEW_DISTROS
 }
 
 ## BASE
@@ -65,14 +65,14 @@ BASE |= {
     "{REGISTRY}/{PROJECT_ID}/base-" + distro + ":" + tag_base + "-" + arch: "//base:" + label + "_" + user + "_" + arch + "_" + distro
     for arch in ARCHITECTURES
     for (tag_base, label, user) in BASE_VARIANTS
-    for distro in DISTROS
+    for distro in DISTROS + PREVIEW_DISTROS
 }
 
 # oci_image_index
 BASE |= {
     "{REGISTRY}/{PROJECT_ID}/base-" + distro + ":" + tag_base: "//base:" + label + "_" + user + "_" + distro
     for (tag_base, label, user) in BASE_VARIANTS
-    for distro in DISTROS
+    for distro in DISTROS + PREVIEW_DISTROS
 }
 
 ## BASE NOSSL
@@ -99,14 +99,14 @@ BASE_NOSSL |= {
     "{REGISTRY}/{PROJECT_ID}/base-nossl-" + distro + ":" + tag_base + "-" + arch: "//base:" + label + "_" + user + "_" + arch + "_" + distro
     for arch in ARCHITECTURES
     for (tag_base, label, user) in BASE_NOSSL_VARIANTS
-    for distro in DISTROS
+    for distro in DISTROS + PREVIEW_DISTROS
 }
 
 # oci_image_index
 BASE_NOSSL |= {
     "{REGISTRY}/{PROJECT_ID}/base-nossl-" + distro + ":" + tag_base: "//base:" + label + "_" + user + "_" + distro
     for (tag_base, label, user) in BASE_NOSSL_VARIANTS
-    for distro in DISTROS
+    for distro in DISTROS + PREVIEW_DISTROS
 }
 
 ## CC

README.md

@@ -48,6 +48,16 @@ These images refer to image indexes with references to all supported architectur
 
 Any other tags are considered deprecated and are no longer updated
 
+#### Debian 13 Preview
+
+These images are not considered stable and may change in subtle ways that break your application. They are made available to allow testing of your systems before upgrading. We will stabilize these in the near future at which point you should revalidate with the latest releases.
+
+| Image                                 | Tags                                  | Architecture Suffixes             |
+| ------------------------------------- | ------------------------------------- | --------------------------------- |
+| gcr.io/distroless/static-debian13     | latest, nonroot, debug, debug-nonroot | amd64, arm64, arm, s390x, ppc64le |
+| gcr.io/distroless/base-debian13       | latest, nonroot, debug, debug-nonroot | amd64, arm64, arm, s390x, ppc64le |
+| gcr.io/distroless/base-nossl-debian13 | latest, nonroot, debug, debug-nonroot | amd64, arm64, arm, s390x, ppc64le |
+
 ## Why is distroless still using gcr.io instead of pkg.dev?
 
 Distroless's serving infrastructure has moved to artifact registry but we still use the gcr.io domain. Users will get the benefits of the newer infrastructure without changing their builds.
@@ -58,7 +68,7 @@ All distroless images are signed by [cosign](https://github.com/sigstore/cosign)
 We recommend verifying any distroless image you use before building your image. You can verify the keyless signature of any distroless image with:
 
 ```sh
-cosign verify $IMAGE_NAME --certificate-oidc-issuer https://accounts.google.com  --certificate-identity keyless@distroless.iam.gserviceaccount.com
+cosign verify $IMAGE_NAME --certificate-oidc-issuer https://accounts.google.com --certificate-identity keyless@distroless.iam.gserviceaccount.com
 ```
 
 ### Entrypoints

private/repos/deb/deb.MODULE.bazel

@@ -16,9 +16,8 @@ apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")
         manifest = "//private/repos/deb:{}.yaml".format(repo),
         package_template = "//private/repos/deb:package.BUILD.tmpl",
         resolve_transitive = False,
-        ### TODO: trixie should add merged-usr support. It's added to rules_distroless but not released yet.
-        ### Once released, bump the version and enable the following line.
-        # mergedusr = repo == "trixie",
+        ## merged usr fs is only enabled on debian13+, remove this line once we remove debian12 builds
+        mergedusr = repo == "trixie",
     )
     for repo in REPOS
 ]