Skip to content

Commit 9a74617

Browse files
loosebazookaloosebazooka
authored
Merge pull request #1909 from GoogleContainerTools/isolate_temurin_debs
Isolate adoptium deb repos from snapshot repos
2 parents 3701c24 + decf073 commit 9a74617

File tree

11 files changed

+276
-166
lines changed

11 files changed

+276
-166
lines changed

‎.github/workflows/update-deb-package-non-snapshots.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: update-non-snapshots
2+
on:
3+
# will send emails to last editor of this cron syntax (distroless-bot)
4+
schedule:
5+
- cron: "35 20 * * *"
6+
# allow this workflow to be manually run
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
build:
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: write
17+
pull-requests: write
18+
19+
steps:
20+
- uses: actions/checkout@v5
21+
- uses: actions/setup-go@v6
22+
with:
23+
go-version: "1.20"
24+
25+
- name: Update non-snapshots
26+
run: ./knife update-non-snapshots
27+
28+
- name: Check for changes
29+
run: |
30+
git status
31+
if [[ $(git status --porcelain) ]]; then
32+
echo "DISTROLESS_DIFF=true" >> "$GITHUB_ENV"
33+
else
34+
echo "No changes detected"
35+
exit 0
36+
fi
37+
38+
- name: Run update lockfile
39+
if: env.DISTROLESS_DIFF
40+
run: bazel mod deps --lockfile_mode=update
41+
42+
- name: Create commits
43+
if: env.DISTROLESS_DIFF
44+
id: create-commits
45+
run: |
46+
git checkout -b update-non-snapshots
47+
48+
# Set identity.
49+
git config --global user.email "[email protected]"
50+
git config --global user.name "Distroless Bot"
51+
52+
# Commit changes
53+
git add .
54+
git commit -s -m "Bumping non-snapshot packages to latest stable versions"
55+
git push --force origin HEAD
56+
57+
- name: Create Pull Request
58+
if: env.DISTROLESS_DIFF
59+
env:
60+
GH_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
61+
run: |
62+
BODY_FILE=$(mktemp)
63+
printf "Bumping non-snapshot packages to latest stable version\n\`\`\`diff\n$DISTROLESS_DIFF\n\`\`\`\n" >> $BODY_FILE
64+
if ! OUTPUT=$(gh pr create -B main -H update-non-snapshots -t "Bumping packages to latest stable versions" --body-file "$BODY_FILE" 2>&1) ; then
65+
echo $OUTPUT
66+
if [[ "${OUTPUT}" =~ "already exists" ]]; then
67+
echo "PR already exists and it was updated. Ending successfully";
68+
exit 0;
69+
else
70+
exit 1;
71+
fi
72+
fi

‎MODULE.bazel.lock‎

Lines changed: 4 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/java.bzl‎

Lines changed: 26 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -65,21 +65,21 @@ def java_build_base_image(distro, arch):
6565
base = ("//base:base_nossl" if (not ("debug" in mode)) else "//base:base_nossl_debug") + "_" + user + "_" + arch + "_" + distro,
6666
env = {"LANG": "C.UTF-8"},
6767
tars = [
68-
deb.package(arch, distro, "zlib1g"),
69-
deb.package(arch, distro, "libjpeg62-turbo"),
70-
deb.package(arch, distro, "liblcms2-2"),
71-
deb.package(arch, distro, "libfreetype6"),
72-
deb.package(arch, distro, "fonts-dejavu-core"),
73-
deb.package(arch, distro, "fontconfig-config"),
74-
deb.package(arch, distro, "libexpat1"),
75-
deb.package(arch, distro, "libfontconfig1"),
76-
deb.package(arch, distro, "libuuid1"),
77-
deb.package(arch, distro, "libbrotli1"),
78-
deb.package(arch, distro, "libcrypt1"),
79-
deb.package(arch, distro, "libstdc++6"),
80-
deb.package(arch, distro, "libgcc-s1"),
68+
deb.package(arch, distro, "zlib1g", "java"),
69+
deb.package(arch, distro, "libjpeg62-turbo", "java"),
70+
deb.package(arch, distro, "liblcms2-2", "java"),
71+
deb.package(arch, distro, "libfreetype6", "java"),
72+
deb.package(arch, distro, "fonts-dejavu-core", "java"),
73+
deb.package(arch, distro, "fontconfig-config", "java"),
74+
deb.package(arch, distro, "libexpat1", "java"),
75+
deb.package(arch, distro, "libfontconfig1", "java"),
76+
deb.package(arch, distro, "libuuid1", "java"),
77+
deb.package(arch, distro, "libbrotli1", "java"),
78+
deb.package(arch, distro, "libcrypt1", "java"),
79+
deb.package(arch, distro, "libstdc++6", "java"),
80+
deb.package(arch, distro, "libgcc-s1", "java"),
8181
"//common:locale_" + distro + "_" + arch,
82-
] + [deb.package(arch, distro, library) for library in DISTRO_SPECIFIC_LIBRARIES["build_base"][distro]],
82+
] + [deb.package(arch, distro, library, "java") for library in DISTRO_SPECIFIC_LIBRARIES["build_base"][distro]],
8383
)
8484
for mode in DEBUG_MODE
8585
for user in USERS
@@ -122,11 +122,11 @@ def java_base_image(distro, arch):
122122
base = "java_build_base" + mode + "_" + user + "_" + arch + "_" + distro,
123123
env = {"LANG": "C.UTF-8"},
124124
tars = [
125-
deb.package(arch, distro, "libharfbuzz0b"),
126-
deb.package(arch, distro, "libgraphite2-3"),
127-
deb.package(arch, distro, "libpcre2-8-0"), # required for libharfbuzz0b but remove for temurin installs
125+
deb.package(arch, distro, "libharfbuzz0b", "java"),
126+
deb.package(arch, distro, "libgraphite2-3", "java"),
127+
deb.package(arch, distro, "libpcre2-8-0", "java"), # required for libharfbuzz0b but remove for temurin installs
128128
":cacerts_java_" + arch + "_" + distro,
129-
] + [deb.package(arch, distro, library) for library in DISTRO_SPECIFIC_LIBRARIES["base"][distro]],
129+
] + [deb.package(arch, distro, library, "java") for library in DISTRO_SPECIFIC_LIBRARIES["base"][distro]],
130130
)
131131
for mode in DEBUG_MODE
132132
for user in USERS
@@ -280,6 +280,7 @@ def java_temurin_image_from_adoptium_debs(distro, java_version, arch):
280280
arch,
281281
distro,
282282
"temurin-" + java_version + "-jre",
283+
"adoptium",
283284
),
284285
],
285286
)
@@ -296,6 +297,7 @@ def java_temurin_image_from_adoptium_debs(distro, java_version, arch):
296297
arch,
297298
distro,
298299
"temurin-" + java_version + "-jdk",
300+
"adoptium",
299301
),
300302
],
301303
)
@@ -316,6 +318,7 @@ def java_temurin_image_from_adoptium_debs(distro, java_version, arch):
316318
arch,
317319
distro,
318320
"temurin-" + java_version + "-jre",
321+
"adoptium",
319322
)),
320323
},
321324
tars = [
@@ -344,6 +347,7 @@ def java_temurin_image_from_adoptium_debs(distro, java_version, arch):
344347
arch,
345348
distro,
346349
"temurin-" + java_version + "-jdk",
350+
"adoptium",
347351
)),
348352
},
349353
tars = [
@@ -378,6 +382,7 @@ def java_openjdk_image(distro, java_version, arch):
378382
arch,
379383
distro,
380384
"openjdk-" + java_version + "-jre-headless",
385+
"java",
381386
),
382387
],
383388
)
@@ -398,6 +403,7 @@ def java_openjdk_image(distro, java_version, arch):
398403
arch,
399404
distro,
400405
"openjdk-" + java_version + "-jre-headless",
406+
"java",
401407
)),
402408
},
403409
tars = [
@@ -423,6 +429,7 @@ def java_openjdk_image(distro, java_version, arch):
423429
arch,
424430
distro,
425431
"openjdk-" + java_version + "-jre-headless",
432+
"java",
426433
)),
427434
},
428435
tars = [
@@ -431,6 +438,7 @@ def java_openjdk_image(distro, java_version, arch):
431438
arch,
432439
distro,
433440
"openjdk-" + java_version + "-jdk-headless",
441+
"java",
434442
),
435443
],
436444
)

‎knife‎

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -22,20 +22,27 @@ if [ $(uname) == "Darwin" ]; then
2222
export PATH="/opt/homebrew/opt/gnu-sed/libexec/gnubin:$PATH"
2323
fi
2424

25-
function cmd_lock() {
26-
echo "🚧 Querying for repos (temporarily using hardcoded repos)"
25+
function cmd_lock_all() {
26+
cmd_lock_snapshots
27+
cmd_lock_non_snapshots
28+
}
29+
30+
function cmd_lock_snapshots() {
31+
echo "🚧 Querying for snapshot repos"
32+
echo ""
33+
local repos=$(grep -l snapshot.debian.org ./private/repos/deb/*.yaml | xargs -L 1 basename | cut -d. -f 1)
34+
_cmd_lock "$repos"
35+
}
36+
37+
function cmd_lock_non_snapshots() {
38+
echo "🚧 Querying for non_snapshot repos"
2739
echo ""
28-
# temporarily hardcode right now (query doesn't work after bzl mod)
29-
local repos=$(cat <<EOL
30-
trixie
31-
trixie_java
32-
bookworm
33-
bookworm_java
34-
bookworm_python
35-
EOL
36-
)
37-
#repos=$(bazel query "kind('deb_package_index', //external:*)" --output=label 2>/dev/null | cut -d: -f2)
40+
local repos=$(grep -lL snapshot.debian.org ./private/repos/deb/*.yaml | xargs -L 1 basename | cut -d. -f 1)
41+
_cmd_lock "$repos"
42+
}
3843

44+
function _cmd_lock() {
45+
local repos="$1"
3946
for repo in $repos; do
4047
for i in $(seq 10); do
4148
echo "🔑 Locking $repo (attempt ${i})"
@@ -93,6 +100,11 @@ function cmd_update_snapshots() {
93100
fi
94101

95102
for mpath in "./private/repos/deb/"*.yaml; do
103+
if ! grep -q "snapshot.debian.org" "$mpath"; then
104+
echo "ignoring non-snapshot repo $mpath"
105+
continue
106+
fi
107+
96108
current=$(grep -oE "debian/([0-9]+T[0-9]+Z)" $mpath | cut -d/ -f2 | head -n1)
97109
current_security=$(grep -oE "debian-security/([0-9]+T[0-9]+Z)" $mpath | cut -d/ -f2 | head -n1)
98110

@@ -120,7 +132,7 @@ function cmd_github_update_snapshots() {
120132
local tmp=$(mktemp -d)
121133
jq -nr 'inputs.packages[] | .key + " " + .sha256' ./private/repos/deb/*.lock.json | sort > "$tmp/old.hashes"
122134
cmd_update_snapshots
123-
cmd_lock
135+
cmd_lock_snapshots
124136
jq -nr 'inputs.packages[] | .key + " " + .sha256' ./private/repos/deb/*.lock.json | sort > "$tmp/new.hashes"
125137
diff "$tmp/old.hashes" "$tmp/new.hashes" | tee "$tmp/diff" || printf "DISTROLESS_DIFF<<EOF\n$(<$tmp/diff)\nEOF" >> "$GITHUB_ENV"
126138
}
@@ -201,11 +213,14 @@ function cmd_deb_versions () {
201213

202214
case "${1:-"~~nocmd"}" in
203215
lock)
204-
cmd_lock
216+
cmd_lock_all
205217
;;
206218
update-snapshots)
207219
cmd_update_snapshots
208220
;;
221+
update-non-snapshots)
222+
cmd_lock_non_snapshots
223+
;;
209224
lint)
210225
cmd_lint
211226
;;

‎private/repos/deb/deb.MODULE.bazel‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
REPOS = [
44
"trixie",
55
"trixie_java",
6+
"trixie_adoptium",
67
"bookworm",
78
"bookworm_java",
89
"bookworm_python",
@@ -23,7 +24,7 @@ apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")
2324
for repo in REPOS
2425
]
2526

26-
use_repo(apt, "bookworm", "bookworm_java", "bookworm_python", "trixie", "trixie_java")
27+
use_repo(apt, "bookworm", "bookworm_java", "bookworm_python", "trixie", "trixie_java", "trixie_adoptium")
2728

2829
### VERSIONS HUB REPO ###
2930
version = use_extension("//private/extensions:version.bzl", "version")

‎private/repos/deb/trixie_adoptium.lock.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
{
2+
"packages": [
3+
{
4+
"arch": "amd64",
5+
"dependencies": [],
6+
"key": "temurin-25-jre_25.0.1.0.0-p-8-0_amd64",
7+
"name": "temurin-25-jre",
8+
"sha256": "1e9bcd6b8f04d52d873cc2d7a6fd6acfca4c113332199b7d93d90d7ba23b4c81",
9+
"urls": [
10+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jre_25.0.1.0.0+8-0_amd64.deb"
11+
],
12+
"version": "25.0.1.0.0+8-0"
13+
},
14+
{
15+
"arch": "amd64",
16+
"dependencies": [],
17+
"key": "temurin-25-jdk_25.0.1.0.0-p-8-0_amd64",
18+
"name": "temurin-25-jdk",
19+
"sha256": "07f40a8d947daa219f3e055350667e1eed9a8613f2f28c30ee512c6725a529b0",
20+
"urls": [
21+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jdk_25.0.1.0.0+8-0_amd64.deb"
22+
],
23+
"version": "25.0.1.0.0+8-0"
24+
},
25+
{
26+
"arch": "arm64",
27+
"dependencies": [],
28+
"key": "temurin-25-jre_25.0.1.0.0-p-8-0_arm64",
29+
"name": "temurin-25-jre",
30+
"sha256": "ff4cc726e043a7749a5c45961f02150f037a21b7d5669edef985db12401cebb2",
31+
"urls": [
32+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jre_25.0.1.0.0+8-0_arm64.deb"
33+
],
34+
"version": "25.0.1.0.0+8-0"
35+
},
36+
{
37+
"arch": "arm64",
38+
"dependencies": [],
39+
"key": "temurin-25-jdk_25.0.1.0.0-p-8-0_arm64",
40+
"name": "temurin-25-jdk",
41+
"sha256": "b79f2cbfd80fe8eb8577795268d617adadb93737877e8c11e4501f6fd15ee16b",
42+
"urls": [
43+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jdk_25.0.1.0.0+8-0_arm64.deb"
44+
],
45+
"version": "25.0.1.0.0+8-0"
46+
},
47+
{
48+
"arch": "s390x",
49+
"dependencies": [],
50+
"key": "temurin-25-jre_25.0.1.0.0-p-8-0_s390x",
51+
"name": "temurin-25-jre",
52+
"sha256": "23d540398ec631be9fff83942b63190559b7781518236534fb0ec77ca3d3419d",
53+
"urls": [
54+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jre_25.0.1.0.0+8-0_s390x.deb"
55+
],
56+
"version": "25.0.1.0.0+8-0"
57+
},
58+
{
59+
"arch": "s390x",
60+
"dependencies": [],
61+
"key": "temurin-25-jdk_25.0.1.0.0-p-8-0_s390x",
62+
"name": "temurin-25-jdk",
63+
"sha256": "8fcdb2eee762aaac4bbb0ea5ea135add8dad2db1cb3cd3dc42c3058262139a28",
64+
"urls": [
65+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jdk_25.0.1.0.0+8-0_s390x.deb"
66+
],
67+
"version": "25.0.1.0.0+8-0"
68+
},
69+
{
70+
"arch": "ppc64el",
71+
"dependencies": [],
72+
"key": "temurin-25-jre_25.0.0.0.0-p-36-0_ppc64el",
73+
"name": "temurin-25-jre",
74+
"sha256": "193f646166bb7dd5dc15b9ebe2f18bfa7b8d2fc2baee72245bbd5dc09b06e235",
75+
"urls": [
76+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jre_25.0.0.0.0+36-0_ppc64el.deb"
77+
],
78+
"version": "25.0.0.0.0+36-0"
79+
},
80+
{
81+
"arch": "ppc64el",
82+
"dependencies": [],
83+
"key": "temurin-25-jdk_25.0.0.0.0-p-36-0_ppc64el",
84+
"name": "temurin-25-jdk",
85+
"sha256": "9cfc8b38378c89ccc97a50f6156eacc1a0ed5e523fe54c375bc1d0d1fdbbbeb0",
86+
"urls": [
87+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jdk_25.0.0.0.0+36-0_ppc64el.deb"
88+
],
89+
"version": "25.0.0.0.0+36-0"
90+
}
91+
],
92+
"version": 1
93+
}

‎private/repos/deb/trixie_adoptium.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# debian 13, java from adoptium repositories
2+
version: 1
3+
4+
sources:
5+
# adoptium
6+
- channel: trixie main
7+
url: https://packages.adoptium.net/artifactory/deb
8+
9+
archs:
10+
- amd64
11+
- arm64
12+
- s390x
13+
- ppc64el
14+
15+
packages:
16+
- temurin-25-jre
17+
- temurin-25-jdk

0 commit comments

Comments
 (0)