Mcrich23
diff --git a/‎.github/workflows/pr-build.yml‎
Lines changed: 29 additions & 0 deletions b/‎.github/workflows/pr-build.yml‎
Lines changed: 29 additions & 0 deletions
diff --git a/‎.github/workflows/pr-label-apply.yml‎
Lines changed: 1 addition & 9 deletions b/‎.github/workflows/pr-label-apply.yml‎
Lines changed: 1 addition & 9 deletions
diff --git a/‎Makefile‎
Lines changed: 4 additions & 2 deletions b/‎Makefile‎
Lines changed: 4 additions & 2 deletions
diff --git a/‎Package.resolved‎
Lines changed: 3 additions & 3 deletions b/‎Package.resolved‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎Package.swift‎
Lines changed: 16 additions & 4 deletions b/‎Package.swift‎
Lines changed: 16 additions & 4 deletions
diff --git a/‎Sources/ContainerBuild/BuildFSSync.swift‎
Lines changed: 21 additions & 1 deletion b/‎Sources/ContainerBuild/BuildFSSync.swift‎
Lines changed: 21 additions & 1 deletion
diff --git a/‎Sources/ContainerBuild/BuildImageResolver.swift‎
Lines changed: 6 additions & 1 deletion b/‎Sources/ContainerBuild/BuildImageResolver.swift‎
Lines changed: 6 additions & 1 deletion
diff --git a/‎Sources/ContainerBuild/BuildPipelineHandler.swift‎
Lines changed: 1 addition & 1 deletion b/‎Sources/ContainerBuild/BuildPipelineHandler.swift‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎Sources/ContainerBuild/Builder.swift‎
Lines changed: 3 additions & 0 deletions b/‎Sources/ContainerBuild/Builder.swift‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎Sources/ContainerCommands/AggregateError.swift‎
Lines changed: 32 additions & 0 deletions b/‎Sources/ContainerCommands/AggregateError.swift‎
Lines changed: 32 additions & 0 deletions
@@ -8,6 +8,35 @@ on:
     types: [opened, reopened, synchronize]
 
 jobs:
+  verify-signatures:
+    name: Verify commit signatures
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check all commits are signed
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          commits=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/commits --paginate)
+          unsigned_commits=""
+
+          while IFS='|' read -r sha author verified; do
+            if [ "$verified" != "true" ]; then
+              unsigned_commits="$unsigned_commits  - $sha by $author\n"
+            fi
+          done < <(echo "$commits" | jq -r '.[] | "\(.sha)|\(.commit.author.name)|\(.commit.verification.verified)"')
+
+          if [ -n "$unsigned_commits" ]; then
+            echo "::error::The following commits are not signed:"
+            echo -e "$unsigned_commits"
+            echo ""
+            echo "Please sign your commits. See:"
+            echo  "  - https://github.com/apple/containerization/blob/main/CONTRIBUTING.md#pull-requests"
+            echo  "  - https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
+            exit 1
+          fi
+
+          echo "All commits are signed!"
+
   build:
     name: Invoke build
     uses: ./.github/workflows/common.yml
 
@@ -29,20 +29,12 @@ jobs:
           run-id: ${{ github.event.workflow_run.id }}
           pattern: pr-metadata-*
           merge-multiple: false
-        continue-on-error: true
         id: download-artifact
 
       - name: Read PR number
         id: pr-number
         run: |
-          METADATA_DIR=$(find . -type d -name "pr-metadata-*" 2>/dev/null | head -n 1)
-          
-          if [ -z "$METADATA_DIR" ]; then
-            echo "No metadata found"
-            exit 1
-          fi
-          
-          PR_NUMBER=$(cat "${METADATA_DIR}/pr-number.txt")
+          PR_NUMBER=$(cat "pr-number.txt")
           echo "number=${PR_NUMBER}" >> $GITHUB_OUTPUT
           echo "PR Number: ${PR_NUMBER}"
       
 
@@ -145,7 +145,7 @@ test:
 .PHONY: install-kernel
 install-kernel:
 	@bin/container system stop || true
-	@bin/container system start --enable-kernel-install $(SYSTEM_START_OPTS)
+	@bin/container system start --timeout 60 --enable-kernel-install $(SYSTEM_START_OPTS)
 
 .PHONY: coverage
 coverage: init-block
@@ -176,7 +176,7 @@ integration: init-block
 	@echo Ensuring apiserver stopped before the CLI integration tests...
 	@bin/container system stop && sleep 3 && scripts/ensure-container-stopped.sh
 	@echo Running the integration tests...
-	@bin/container system start $(SYSTEM_START_OPTS) && \
+	@bin/container system start --timeout 60 $(SYSTEM_START_OPTS) && \
 	echo "Starting CLI integration tests" && \
 	{ \
 		exit_code=0; \
@@ -188,9 +188,11 @@ integration: init-block
 		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIRunCommand2 || exit_code=1 ; \
 		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIRunCommand3 || exit_code=1 ; \
 		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIPruneCommand || exit_code=1 ; \
+		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIRegistry || exit_code=1 ; \
 		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIStatsCommand || exit_code=1 ; \
 		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIImagesCommand || exit_code=1 ; \
 		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIRunBase || exit_code=1 ; \
+		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIRunInitImage || exit_code=1 ; \
 		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIBuildBase || exit_code=1 ; \
 		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIVolumes || exit_code=1 ; \
 		$(SWIFT) test -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --filter TestCLIKernelSet || exit_code=1 ; \
 
@@ -23,8 +23,8 @@ import PackageDescription
 
 let releaseVersion = ProcessInfo.processInfo.environment["RELEASE_VERSION"] ?? "0.0.0"
 let gitCommit = ProcessInfo.processInfo.environment["GIT_COMMIT"] ?? "unspecified"
-let builderShimVersion = "0.7.0"
-let scVersion = "0.24.5"
+let builderShimVersion = "0.8.0"
+let scVersion = "0.25.0"
 
 let package = Package(
     name: "container",
@@ -313,7 +313,6 @@ let package = Package(
                 .product(name: "ContainerizationOS", package: "containerization"),
                 .product(name: "ArgumentParser", package: "swift-argument-parser"),
                 "ContainerAPIClient",
-                "ContainerNetworkServiceClient",
                 "ContainerPersistence",
                 "ContainerResource",
                 "ContainerSandboxServiceClient",
@@ -325,6 +324,7 @@ let package = Package(
         .target(
             name: "ContainerSandboxServiceClient",
             dependencies: [
+                "ContainerAPIClient",
                 "ContainerResource",
                 "ContainerXPC",
             ],
@@ -333,14 +333,18 @@ let package = Package(
         .target(
             name: "ContainerResource",
             dependencies: [
-                .product(name: "Containerization", package: "containerization")
+                .product(name: "Containerization", package: "containerization"),
+                "ContainerXPC",
+                "CAuditToken",
+                "CVersion",
             ]
         ),
         .testTarget(
             name: "ContainerResourceTests",
             dependencies: [
                 .product(name: "Containerization", package: "containerization"),
                 .product(name: "ContainerizationExtras", package: "containerization"),
+                "ContainerAPIService",
                 "ContainerResource",
             ]
         ),
@@ -373,6 +377,14 @@ let package = Package(
                 "ContainerPlugin"
             ]
         ),
+        .testTarget(
+            name: "ContainerSandboxServiceTests",
+            dependencies: [
+                .product(name: "Containerization", package: "containerization"),
+                "ContainerResource",
+                "ContainerSandboxServiceClient",
+            ]
+        ),
         .target(
             name: "ContainerXPC",
             dependencies: [
 
@@ -18,6 +18,7 @@ import Collections
 import ContainerAPIClient
 import ContainerizationArchive
 import ContainerizationOCI
+import CryptoKit
 import Foundation
 import GRPC
 
@@ -199,7 +200,7 @@ actor BuildFSSync: BuildPipelineHandler {
             format: .paxRestricted,
             filter: .none)
 
-        try Archiver.compress(
+        let tarHash = try Archiver.compress(
             source: contextDir,
             destination: tarURL,
             writerConfiguration: writerCfg
@@ -229,6 +230,25 @@ actor BuildFSSync: BuildPipelineHandler {
                 pathInArchive: URL(fileURLWithPath: rel))
         }
 
+        let hash = tarHash.compactMap { String(format: "%02x", $0) }.joined()
+        let header = BuildTransfer(
+            id: packet.id,
+            source: tarURL.path,
+            complete: false,
+            isDir: false,
+            metadata: [
+                "os": "linux",
+                "stage": "fssync",
+                "mode": "tar",
+                "hash": hash,
+            ]
+        )
+        var resp = ClientStream()
+        resp.buildID = buildID
+        resp.buildTransfer = header
+        resp.packetType = .buildTransfer(header)
+        sender.yield(resp)
+
         for try await chunk in try tarURL.bufferedCopyReader() {
             let part = BuildTransfer(
                 id: packet.id,
 
@@ -26,11 +26,13 @@ struct BuildImageResolver: BuildPipelineHandler {
     let contentStore: ContentStore
     let quiet: Bool
     let output: FileHandle
+    let pull: Bool
 
-    public init(_ contentStore: ContentStore, quiet: Bool = false, output: FileHandle = FileHandle.standardError) throws {
+    public init(_ contentStore: ContentStore, quiet: Bool = false, output: FileHandle = FileHandle.standardError, pull: Bool = false) throws {
         self.contentStore = contentStore
         self.quiet = quiet
         self.output = output
+        self.pull = pull
     }
 
     func accept(_ packet: ServerStream) throws -> Bool {
@@ -72,6 +74,9 @@ struct BuildImageResolver: BuildPipelineHandler {
             defer { progress.finish() }
             progress.start()
 
+            if self.pull {
+                return try await ClientImage.pull(reference: ref, platform: platform, progressUpdate: progress.handler)
+            }
             // Use fetch() which checks cache first, then pulls if needed
             return try await ClientImage.fetch(reference: ref, platform: platform, progressUpdate: progress.handler)
         }()
 
@@ -30,7 +30,7 @@ public actor BuildPipeline {
             [
                 try BuildFSSync(URL(filePath: config.contextDir)),
                 try BuildRemoteContentProxy(config.contentStore),
-                try BuildImageResolver(config.contentStore, quiet: config.quiet, output: config.terminal?.handle ?? FileHandle.standardError),
+                try BuildImageResolver(config.contentStore, quiet: config.quiet, output: config.terminal?.handle ?? FileHandle.standardError, pull: config.pull),
                 try BuildStdio(quiet: config.quiet, output: config.terminal?.handle ?? FileHandle.standardError),
             ]
     }
 
@@ -251,6 +251,7 @@ public struct Builder: Sendable {
         public let exports: [BuildExport]
         public let cacheIn: [String]
         public let cacheOut: [String]
+        public let pull: Bool
 
         public init(
             buildID: String,
@@ -268,6 +269,7 @@ public struct Builder: Sendable {
             exports: [BuildExport],
             cacheIn: [String],
             cacheOut: [String],
+            pull: Bool
         ) {
             self.buildID = buildID
             self.contentStore = contentStore
@@ -284,6 +286,7 @@ public struct Builder: Sendable {
             self.exports = exports
             self.cacheIn = cacheIn
             self.cacheOut = cacheOut
+            self.pull = pull
         }
     }
 }
 
@@ -0,0 +1,32 @@
+//===----------------------------------------------------------------------===//
+// Copyright © 2026 Apple Inc. and the container project authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//===----------------------------------------------------------------------===//
+
+/// An error type that aggregates multiple errors into one.
+///
+/// When displayed, each underlying error is printed on its own line.
+public struct AggregateError: Swift.Error, Sendable {
+    public let errors: [any Error]
+
+    public init(_ errors: [any Error]) {
+        self.errors = errors
+    }
+}
+
+extension AggregateError: CustomStringConvertible {
+    public var description: String {
+        errors.map { String(describing: $0) }.joined(separator: "\n")
+    }
+}
Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,7 @@ public actor BuildPipeline {`
`30`	`30`	`[`
`31`	`31`	`try BuildFSSync(URL(filePath: config.contextDir)),`
`32`	`32`	`try BuildRemoteContentProxy(config.contentStore),`
`33`		`- try BuildImageResolver(config.contentStore, quiet: config.quiet, output: config.terminal?.handle ?? FileHandle.standardError),`
	`33`	`+ try BuildImageResolver(config.contentStore, quiet: config.quiet, output: config.terminal?.handle ?? FileHandle.standardError, pull: config.pull),`
`34`	`34`	`try BuildStdio(quiet: config.quiet, output: config.terminal?.handle ?? FileHandle.standardError),`
`35`	`35`	`]`
`36`	`36`	`}`