Skip to content

Commit decf073

Browse files
loosebazookaloosebazooka
committed
Isolate adoptium deb repos from snapshot repos
This keeps the system from updating snapshots when it doesn't need to. This also adds an updater for the adoptium based deb packages, but applies to any external repo file that doesn't include snapshots.debian.org Signed-off-by: Appu Goundan <[email protected]>
1 parent 3701c24 commit decf073

File tree

11 files changed

+276
-166
lines changed

11 files changed

+276
-166
lines changed

‎.github/workflows/update-deb-package-non-snapshots.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: update-non-snapshots
2+
on:
3+
# will send emails to last editor of this cron syntax (distroless-bot)
4+
schedule:
5+
- cron: "35 20 * * *"
6+
# allow this workflow to be manually run
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
build:
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: write
17+
pull-requests: write
18+
19+
steps:
20+
- uses: actions/checkout@v5
21+
- uses: actions/setup-go@v6
22+
with:
23+
go-version: "1.20"
24+
25+
- name: Update non-snapshots
26+
run: ./knife update-non-snapshots
27+
28+
- name: Check for changes
29+
run: |
30+
git status
31+
if [[ $(git status --porcelain) ]]; then
32+
echo "DISTROLESS_DIFF=true" >> "$GITHUB_ENV"
33+
else
34+
echo "No changes detected"
35+
exit 0
36+
fi
37+
38+
- name: Run update lockfile
39+
if: env.DISTROLESS_DIFF
40+
run: bazel mod deps --lockfile_mode=update
41+
42+
- name: Create commits
43+
if: env.DISTROLESS_DIFF
44+
id: create-commits
45+
run: |
46+
git checkout -b update-non-snapshots
47+
48+
# Set identity.
49+
git config --global user.email "[email protected]"
50+
git config --global user.name "Distroless Bot"
51+
52+
# Commit changes
53+
git add .
54+
git commit -s -m "Bumping non-snapshot packages to latest stable versions"
55+
git push --force origin HEAD
56+
57+
- name: Create Pull Request
58+
if: env.DISTROLESS_DIFF
59+
env:
60+
GH_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
61+
run: |
62+
BODY_FILE=$(mktemp)
63+
printf "Bumping non-snapshot packages to latest stable version\n\`\`\`diff\n$DISTROLESS_DIFF\n\`\`\`\n" >> $BODY_FILE
64+
if ! OUTPUT=$(gh pr create -B main -H update-non-snapshots -t "Bumping packages to latest stable versions" --body-file "$BODY_FILE" 2>&1) ; then
65+
echo $OUTPUT
66+
if [[ "${OUTPUT}" =~ "already exists" ]]; then
67+
echo "PR already exists and it was updated. Ending successfully";
68+
exit 0;
69+
else
70+
exit 1;
71+
fi
72+
fi

‎MODULE.bazel.lock‎

Lines changed: 4 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎java/java.bzl‎

Lines changed: 26 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -65,21 +65,21 @@ def java_build_base_image(distro, arch):
6565
base = ("//base:base_nossl" if (not ("debug" in mode)) else "//base:base_nossl_debug") + "_" + user + "_" + arch + "_" + distro,
6666
env = {"LANG": "C.UTF-8"},
6767
tars = [
68-
deb.package(arch, distro, "zlib1g"),
69-
deb.package(arch, distro, "libjpeg62-turbo"),
70-
deb.package(arch, distro, "liblcms2-2"),
71-
deb.package(arch, distro, "libfreetype6"),
72-
deb.package(arch, distro, "fonts-dejavu-core"),
73-
deb.package(arch, distro, "fontconfig-config"),
74-
deb.package(arch, distro, "libexpat1"),
75-
deb.package(arch, distro, "libfontconfig1"),
76-
deb.package(arch, distro, "libuuid1"),
77-
deb.package(arch, distro, "libbrotli1"),
78-
deb.package(arch, distro, "libcrypt1"),
79-
deb.package(arch, distro, "libstdc++6"),
80-
deb.package(arch, distro, "libgcc-s1"),
68+
deb.package(arch, distro, "zlib1g", "java"),
69+
deb.package(arch, distro, "libjpeg62-turbo", "java"),
70+
deb.package(arch, distro, "liblcms2-2", "java"),
71+
deb.package(arch, distro, "libfreetype6", "java"),
72+
deb.package(arch, distro, "fonts-dejavu-core", "java"),
73+
deb.package(arch, distro, "fontconfig-config", "java"),
74+
deb.package(arch, distro, "libexpat1", "java"),
75+
deb.package(arch, distro, "libfontconfig1", "java"),
76+
deb.package(arch, distro, "libuuid1", "java"),
77+
deb.package(arch, distro, "libbrotli1", "java"),
78+
deb.package(arch, distro, "libcrypt1", "java"),
79+
deb.package(arch, distro, "libstdc++6", "java"),
80+
deb.package(arch, distro, "libgcc-s1", "java"),
8181
"//common:locale_" + distro + "_" + arch,
82-
] + [deb.package(arch, distro, library) for library in DISTRO_SPECIFIC_LIBRARIES["build_base"][distro]],
82+
] + [deb.package(arch, distro, library, "java") for library in DISTRO_SPECIFIC_LIBRARIES["build_base"][distro]],
8383
)
8484
for mode in DEBUG_MODE
8585
for user in USERS
@@ -122,11 +122,11 @@ def java_base_image(distro, arch):
122122
base = "java_build_base" + mode + "_" + user + "_" + arch + "_" + distro,
123123
env = {"LANG": "C.UTF-8"},
124124
tars = [
125-
deb.package(arch, distro, "libharfbuzz0b"),
126-
deb.package(arch, distro, "libgraphite2-3"),
127-
deb.package(arch, distro, "libpcre2-8-0"), # required for libharfbuzz0b but remove for temurin installs
125+
deb.package(arch, distro, "libharfbuzz0b", "java"),
126+
deb.package(arch, distro, "libgraphite2-3", "java"),
127+
deb.package(arch, distro, "libpcre2-8-0", "java"), # required for libharfbuzz0b but remove for temurin installs
128128
":cacerts_java_" + arch + "_" + distro,
129-
] + [deb.package(arch, distro, library) for library in DISTRO_SPECIFIC_LIBRARIES["base"][distro]],
129+
] + [deb.package(arch, distro, library, "java") for library in DISTRO_SPECIFIC_LIBRARIES["base"][distro]],
130130
)
131131
for mode in DEBUG_MODE
132132
for user in USERS
@@ -280,6 +280,7 @@ def java_temurin_image_from_adoptium_debs(distro, java_version, arch):
280280
arch,
281281
distro,
282282
"temurin-" + java_version + "-jre",
283+
"adoptium",
283284
),
284285
],
285286
)
@@ -296,6 +297,7 @@ def java_temurin_image_from_adoptium_debs(distro, java_version, arch):
296297
arch,
297298
distro,
298299
"temurin-" + java_version + "-jdk",
300+
"adoptium",
299301
),
300302
],
301303
)
@@ -316,6 +318,7 @@ def java_temurin_image_from_adoptium_debs(distro, java_version, arch):
316318
arch,
317319
distro,
318320
"temurin-" + java_version + "-jre",
321+
"adoptium",
319322
)),
320323
},
321324
tars = [
@@ -344,6 +347,7 @@ def java_temurin_image_from_adoptium_debs(distro, java_version, arch):
344347
arch,
345348
distro,
346349
"temurin-" + java_version + "-jdk",
350+
"adoptium",
347351
)),
348352
},
349353
tars = [
@@ -378,6 +382,7 @@ def java_openjdk_image(distro, java_version, arch):
378382
arch,
379383
distro,
380384
"openjdk-" + java_version + "-jre-headless",
385+
"java",
381386
),
382387
],
383388
)
@@ -398,6 +403,7 @@ def java_openjdk_image(distro, java_version, arch):
398403
arch,
399404
distro,
400405
"openjdk-" + java_version + "-jre-headless",
406+
"java",
401407
)),
402408
},
403409
tars = [
@@ -423,6 +429,7 @@ def java_openjdk_image(distro, java_version, arch):
423429
arch,
424430
distro,
425431
"openjdk-" + java_version + "-jre-headless",
432+
"java",
426433
)),
427434
},
428435
tars = [
@@ -431,6 +438,7 @@ def java_openjdk_image(distro, java_version, arch):
431438
arch,
432439
distro,
433440
"openjdk-" + java_version + "-jdk-headless",
441+
"java",
434442
),
435443
],
436444
)

‎knife‎

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -22,20 +22,27 @@ if [ $(uname) == "Darwin" ]; then
2222
export PATH="/opt/homebrew/opt/gnu-sed/libexec/gnubin:$PATH"
2323
fi
2424

25-
function cmd_lock() {
26-
echo "🚧 Querying for repos (temporarily using hardcoded repos)"
25+
function cmd_lock_all() {
26+
cmd_lock_snapshots
27+
cmd_lock_non_snapshots
28+
}
29+
30+
function cmd_lock_snapshots() {
31+
echo "🚧 Querying for snapshot repos"
32+
echo ""
33+
local repos=$(grep -l snapshot.debian.org ./private/repos/deb/*.yaml | xargs -L 1 basename | cut -d. -f 1)
34+
_cmd_lock "$repos"
35+
}
36+
37+
function cmd_lock_non_snapshots() {
38+
echo "🚧 Querying for non_snapshot repos"
2739
echo ""
28-
# temporarily hardcode right now (query doesn't work after bzl mod)
29-
local repos=$(cat <<EOL
30-
trixie
31-
trixie_java
32-
bookworm
33-
bookworm_java
34-
bookworm_python
35-
EOL
36-
)
37-
#repos=$(bazel query "kind('deb_package_index', //external:*)" --output=label 2>/dev/null | cut -d: -f2)
40+
local repos=$(grep -lL snapshot.debian.org ./private/repos/deb/*.yaml | xargs -L 1 basename | cut -d. -f 1)
41+
_cmd_lock "$repos"
42+
}
3843

44+
function _cmd_lock() {
45+
local repos="$1"
3946
for repo in $repos; do
4047
for i in $(seq 10); do
4148
echo "🔑 Locking $repo (attempt ${i})"
@@ -93,6 +100,11 @@ function cmd_update_snapshots() {
93100
fi
94101

95102
for mpath in "./private/repos/deb/"*.yaml; do
103+
if ! grep -q "snapshot.debian.org" "$mpath"; then
104+
echo "ignoring non-snapshot repo $mpath"
105+
continue
106+
fi
107+
96108
current=$(grep -oE "debian/([0-9]+T[0-9]+Z)" $mpath | cut -d/ -f2 | head -n1)
97109
current_security=$(grep -oE "debian-security/([0-9]+T[0-9]+Z)" $mpath | cut -d/ -f2 | head -n1)
98110

@@ -120,7 +132,7 @@ function cmd_github_update_snapshots() {
120132
local tmp=$(mktemp -d)
121133
jq -nr 'inputs.packages[] | .key + " " + .sha256' ./private/repos/deb/*.lock.json | sort > "$tmp/old.hashes"
122134
cmd_update_snapshots
123-
cmd_lock
135+
cmd_lock_snapshots
124136
jq -nr 'inputs.packages[] | .key + " " + .sha256' ./private/repos/deb/*.lock.json | sort > "$tmp/new.hashes"
125137
diff "$tmp/old.hashes" "$tmp/new.hashes" | tee "$tmp/diff" || printf "DISTROLESS_DIFF<<EOF\n$(<$tmp/diff)\nEOF" >> "$GITHUB_ENV"
126138
}
@@ -201,11 +213,14 @@ function cmd_deb_versions () {
201213

202214
case "${1:-"~~nocmd"}" in
203215
lock)
204-
cmd_lock
216+
cmd_lock_all
205217
;;
206218
update-snapshots)
207219
cmd_update_snapshots
208220
;;
221+
update-non-snapshots)
222+
cmd_lock_non_snapshots
223+
;;
209224
lint)
210225
cmd_lint
211226
;;

‎private/repos/deb/deb.MODULE.bazel‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
REPOS = [
44
"trixie",
55
"trixie_java",
6+
"trixie_adoptium",
67
"bookworm",
78
"bookworm_java",
89
"bookworm_python",
@@ -23,7 +24,7 @@ apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")
2324
for repo in REPOS
2425
]
2526

26-
use_repo(apt, "bookworm", "bookworm_java", "bookworm_python", "trixie", "trixie_java")
27+
use_repo(apt, "bookworm", "bookworm_java", "bookworm_python", "trixie", "trixie_java", "trixie_adoptium")
2728

2829
### VERSIONS HUB REPO ###
2930
version = use_extension("//private/extensions:version.bzl", "version")

‎private/repos/deb/trixie_adoptium.lock.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
{
2+
"packages": [
3+
{
4+
"arch": "amd64",
5+
"dependencies": [],
6+
"key": "temurin-25-jre_25.0.1.0.0-p-8-0_amd64",
7+
"name": "temurin-25-jre",
8+
"sha256": "1e9bcd6b8f04d52d873cc2d7a6fd6acfca4c113332199b7d93d90d7ba23b4c81",
9+
"urls": [
10+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jre_25.0.1.0.0+8-0_amd64.deb"
11+
],
12+
"version": "25.0.1.0.0+8-0"
13+
},
14+
{
15+
"arch": "amd64",
16+
"dependencies": [],
17+
"key": "temurin-25-jdk_25.0.1.0.0-p-8-0_amd64",
18+
"name": "temurin-25-jdk",
19+
"sha256": "07f40a8d947daa219f3e055350667e1eed9a8613f2f28c30ee512c6725a529b0",
20+
"urls": [
21+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jdk_25.0.1.0.0+8-0_amd64.deb"
22+
],
23+
"version": "25.0.1.0.0+8-0"
24+
},
25+
{
26+
"arch": "arm64",
27+
"dependencies": [],
28+
"key": "temurin-25-jre_25.0.1.0.0-p-8-0_arm64",
29+
"name": "temurin-25-jre",
30+
"sha256": "ff4cc726e043a7749a5c45961f02150f037a21b7d5669edef985db12401cebb2",
31+
"urls": [
32+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jre_25.0.1.0.0+8-0_arm64.deb"
33+
],
34+
"version": "25.0.1.0.0+8-0"
35+
},
36+
{
37+
"arch": "arm64",
38+
"dependencies": [],
39+
"key": "temurin-25-jdk_25.0.1.0.0-p-8-0_arm64",
40+
"name": "temurin-25-jdk",
41+
"sha256": "b79f2cbfd80fe8eb8577795268d617adadb93737877e8c11e4501f6fd15ee16b",
42+
"urls": [
43+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jdk_25.0.1.0.0+8-0_arm64.deb"
44+
],
45+
"version": "25.0.1.0.0+8-0"
46+
},
47+
{
48+
"arch": "s390x",
49+
"dependencies": [],
50+
"key": "temurin-25-jre_25.0.1.0.0-p-8-0_s390x",
51+
"name": "temurin-25-jre",
52+
"sha256": "23d540398ec631be9fff83942b63190559b7781518236534fb0ec77ca3d3419d",
53+
"urls": [
54+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jre_25.0.1.0.0+8-0_s390x.deb"
55+
],
56+
"version": "25.0.1.0.0+8-0"
57+
},
58+
{
59+
"arch": "s390x",
60+
"dependencies": [],
61+
"key": "temurin-25-jdk_25.0.1.0.0-p-8-0_s390x",
62+
"name": "temurin-25-jdk",
63+
"sha256": "8fcdb2eee762aaac4bbb0ea5ea135add8dad2db1cb3cd3dc42c3058262139a28",
64+
"urls": [
65+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jdk_25.0.1.0.0+8-0_s390x.deb"
66+
],
67+
"version": "25.0.1.0.0+8-0"
68+
},
69+
{
70+
"arch": "ppc64el",
71+
"dependencies": [],
72+
"key": "temurin-25-jre_25.0.0.0.0-p-36-0_ppc64el",
73+
"name": "temurin-25-jre",
74+
"sha256": "193f646166bb7dd5dc15b9ebe2f18bfa7b8d2fc2baee72245bbd5dc09b06e235",
75+
"urls": [
76+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jre_25.0.0.0.0+36-0_ppc64el.deb"
77+
],
78+
"version": "25.0.0.0.0+36-0"
79+
},
80+
{
81+
"arch": "ppc64el",
82+
"dependencies": [],
83+
"key": "temurin-25-jdk_25.0.0.0.0-p-36-0_ppc64el",
84+
"name": "temurin-25-jdk",
85+
"sha256": "9cfc8b38378c89ccc97a50f6156eacc1a0ed5e523fe54c375bc1d0d1fdbbbeb0",
86+
"urls": [
87+
"https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-25/temurin-25-jdk_25.0.0.0.0+36-0_ppc64el.deb"
88+
],
89+
"version": "25.0.0.0.0+36-0"
90+
}
91+
],
92+
"version": 1
93+
}

‎private/repos/deb/trixie_adoptium.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# debian 13, java from adoptium repositories
2+
version: 1
3+
4+
sources:
5+
# adoptium
6+
- channel: trixie main
7+
url: https://packages.adoptium.net/artifactory/deb
8+
9+
archs:
10+
- amd64
11+
- arm64
12+
- s390x
13+
- ppc64el
14+
15+
packages:
16+
- temurin-25-jre
17+
- temurin-25-jdk

0 commit comments

Comments
 (0)