Skip to content

Commit 850e668

Browse files
smosersmoser
authored
Merge branch 'main' into feature/openmpi
2 parents 0781a5d + 78ac764 commit 850e668

61 files changed

Lines changed: 342 additions & 212 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/build-world.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
# permissions:
2525

2626
container:
27-
image: ghcr.io/wolfi-dev/sdk:latest@sha256:110c4bc0a8941606034ee7af12f1197b4a6b6f6434fd4b4bbf61de501e18ffd1
27+
image: ghcr.io/wolfi-dev/sdk:latest@sha256:c2f7cbbfb67ff9cad47e25ff8eb87945a4c5a0a81b2fa9e93a1d9ac6504a8df5
2828
# TODO: Deprivilege
2929
options: |
3030
--cap-add NET_ADMIN --cap-add SYS_ADMIN --device /dev/fuse --security-opt seccomp=unconfined --security-opt apparmor:unconfined
@@ -55,7 +55,7 @@ jobs:
5555
# TODO: See how big these get, maybe we only upload failures and shorten the retention, or throw them in GCS
5656
- name: Upload build logs
5757
if: always()
58-
uses: actions/upload-artifact@v3
58+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
5959
with:
6060
name: buildlogs
6161
path: ./packages/**/buildlogs/*.log

‎.github/workflows/build.yaml‎

Lines changed: 24 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
contents: read
3030

3131
container:
32-
image: ghcr.io/wolfi-dev/sdk:latest@sha256:110c4bc0a8941606034ee7af12f1197b4a6b6f6434fd4b4bbf61de501e18ffd1
32+
image: ghcr.io/wolfi-dev/sdk:latest@sha256:c2f7cbbfb67ff9cad47e25ff8eb87945a4c5a0a81b2fa9e93a1d9ac6504a8df5
3333
# TODO: Deprivilege
3434
options: |
3535
--cap-add NET_ADMIN --cap-add SYS_ADMIN --device /dev/fuse --security-opt seccomp=unconfined --security-opt apparmor:unconfined
@@ -122,7 +122,7 @@ jobs:
122122
# Always run this step for https://github.com/wolfi-dev/os/issues/8698
123123
- if: ${{ always() }}
124124
name: 'Upload built packages archive to GitHub Artifacts'
125-
uses: actions/upload-artifact@v3
125+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
126126
with:
127127
name: packages-${{ matrix.arch }}
128128
path: /tmp/packages-${{ matrix.arch }}.tar.gz
@@ -142,7 +142,7 @@ jobs:
142142

143143
container:
144144
# NOTE: This step only signs and uploads, so it doesn't need any privileges
145-
image: ghcr.io/wolfi-dev/sdk:latest@sha256:110c4bc0a8941606034ee7af12f1197b4a6b6f6434fd4b4bbf61de501e18ffd1
145+
image: ghcr.io/wolfi-dev/sdk:latest@sha256:c2f7cbbfb67ff9cad47e25ff8eb87945a4c5a0a81b2fa9e93a1d9ac6504a8df5
146146

147147
steps:
148148
- uses: actions/checkout@v4
@@ -154,33 +154,32 @@ jobs:
154154
git config --global --add safe.directory "$(pwd)"
155155
156156
- name: 'Download x86_64 package archives'
157-
uses: actions/download-artifact@v3
157+
uses: actions/download-artifact@21e5c25de9cf2ee24742cd3e822327f3be6dd2a3 # v4.1.1
158158
with:
159159
path: /tmp/artifacts/
160160
name: packages-x86_64
161161

162162
- name: 'Download aarch64 package archives'
163-
uses: actions/download-artifact@v3
163+
uses: actions/download-artifact@21e5c25de9cf2ee24742cd3e822327f3be6dd2a3 # v4.1.1
164164
with:
165165
path: /tmp/artifacts/
166166
name: packages-aarch64
167167

168-
- name: 'Authenticate to Google Cloud'
168+
# This is managed here: https://github.com/chainguard-dev/secrets/blob/main/wolfi-dev.tf
169+
- uses: google-github-actions/auth@a6e2e39c0a0331da29f7fd2c2a20a427e8d3ad1f # v2.1.1
169170
id: auth
170-
uses: google-github-actions/auth@f6de81663f7788d05bd15bcce18f0e57f23f0846 # v2.0.1
171171
with:
172-
workload_identity_provider: "projects/618116202522/locations/global/workloadIdentityPools/prod-shared-e350/providers/prod-shared-gha"
173-
service_account: "prod-images-ci@prod-images-c6e5.iam.gserviceaccount.com"
174-
172+
workload_identity_provider: "projects/12758742386/locations/global/workloadIdentityPools/github-pool/providers/github-provider"
173+
service_account: "wolfi-dev@chainguard-github-secrets.iam.gserviceaccount.com"
175174
- uses: google-github-actions/setup-gcloud@5a5f7b85fca43e76e53463acaa9d408a03c98d3a # v2.0.1
176175
with:
177-
project_id: "prod-images-c6e5"
178-
176+
project_id: "chainguard-github-secrets"
179177
- uses: 'google-github-actions/get-secretmanager-secrets@ae0d4054c32840e2ced71207a9df55161ae3debc' # v2.0.0
180178
id: secrets
181179
with:
182180
secrets: |-
183-
token:prod-images-c6e5/melange-signing-key
181+
token:chainguard-github-secrets/wolfi-dev-signing-key
182+
184183
- run: echo "${{ steps.secrets.outputs.token }}" > ./wolfi-signing.rsa
185184
- run: |
186185
mkdir -p /etc/apk/keys
@@ -208,6 +207,15 @@ jobs:
208207
# of an abundance of caution.
209208
- run: rm ./wolfi-signing.rsa
210209

210+
# We use a different GSA for our interaction with GCS.
211+
- uses: google-github-actions/auth@f6de81663f7788d05bd15bcce18f0e57f23f0846 # v2.0.1
212+
with:
213+
workload_identity_provider: "projects/618116202522/locations/global/workloadIdentityPools/prod-shared-e350/providers/prod-shared-gha"
214+
service_account: "prod-images-ci@prod-images-c6e5.iam.gserviceaccount.com"
215+
- uses: google-github-actions/setup-gcloud@5a5f7b85fca43e76e53463acaa9d408a03c98d3a # v2.0.1
216+
with:
217+
project_id: "prod-images-c6e5"
218+
211219
- name: 'Upload packages to GCS'
212220
run: |
213221
for arch in "x86_64" "aarch64"; do
@@ -229,7 +237,7 @@ jobs:
229237
tar -cvzf /tmp/indexes.tar.gz --files-from to-include
230238
231239
- name: 'Upload APKINDEX archive to GitHub Artifacts'
232-
uses: actions/upload-artifact@v3
240+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
233241
with:
234242
name: indexes
235243
path: /tmp/indexes.tar.gz
@@ -246,7 +254,7 @@ jobs:
246254

247255
container:
248256
# NOTE: This step only signs and uploads, so it doesn't need any privileges
249-
image: ghcr.io/wolfi-dev/sdk:latest@sha256:110c4bc0a8941606034ee7af12f1197b4a6b6f6434fd4b4bbf61de501e18ffd1
257+
image: ghcr.io/wolfi-dev/sdk:latest@sha256:c2f7cbbfb67ff9cad47e25ff8eb87945a4c5a0a81b2fa9e93a1d9ac6504a8df5
250258

251259
steps:
252260
- uses: actions/checkout@v4
@@ -269,7 +277,7 @@ jobs:
269277
project_id: prod-images-c6e5
270278

271279
- name: 'Download index archive'
272-
uses: actions/download-artifact@v3
280+
uses: actions/download-artifact@21e5c25de9cf2ee24742cd3e822327f3be6dd2a3 # v4.1.1
273281
with:
274282
path: /tmp/artifacts/
275283
name: indexes

‎.github/workflows/ci-build.yaml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
run: |
3434
# Copy wolfictl out of the wolfictl image and onto PATH
3535
TMP=$(mktemp -d)
36-
docker run --rm -i -v $TMP:/out --entrypoint /bin/sh ghcr.io/wolfi-dev/sdk:latest@sha256:110c4bc0a8941606034ee7af12f1197b4a6b6f6434fd4b4bbf61de501e18ffd1 -c "cp /usr/bin/wolfictl /out"
36+
docker run --rm -i -v $TMP:/out --entrypoint /bin/sh ghcr.io/wolfi-dev/sdk:latest@sha256:c2f7cbbfb67ff9cad47e25ff8eb87945a4c5a0a81b2fa9e93a1d9ac6504a8df5 -c "cp /usr/bin/wolfictl /out"
3737
echo "$TMP" >> $GITHUB_PATH
3838
3939
# Assuming that we have a list of changed files such as `foo.yaml` and `bar.yaml`, this
@@ -70,7 +70,7 @@ jobs:
7070
group: wolfi-builder-${{ matrix.arch }}
7171
needs: changes
7272
container:
73-
image: ghcr.io/wolfi-dev/sdk:latest@sha256:110c4bc0a8941606034ee7af12f1197b4a6b6f6434fd4b4bbf61de501e18ffd1
73+
image: ghcr.io/wolfi-dev/sdk:latest@sha256:c2f7cbbfb67ff9cad47e25ff8eb87945a4c5a0a81b2fa9e93a1d9ac6504a8df5
7474
options: |
7575
--cap-add NET_ADMIN --cap-add SYS_ADMIN --security-opt seccomp=unconfined --security-opt apparmor:unconfined
7676
outputs:
@@ -176,7 +176,7 @@ jobs:
176176
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
177177

178178
- name: 'Upload built packages to GitHub artifacts'
179-
uses: actions/upload-artifact@v3
179+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
180180
with:
181181
path: |
182182
./packages/${{ matrix.arch }}
@@ -192,19 +192,19 @@ jobs:
192192
name: "ABI Compatibility check"
193193
runs-on: ubuntu-latest
194194
container:
195-
image: ghcr.io/wolfi-dev/sdk:latest@sha256:110c4bc0a8941606034ee7af12f1197b4a6b6f6434fd4b4bbf61de501e18ffd1
195+
image: ghcr.io/wolfi-dev/sdk:latest@sha256:c2f7cbbfb67ff9cad47e25ff8eb87945a4c5a0a81b2fa9e93a1d9ac6504a8df5
196196
needs: build
197197
if: needs.build.outputs.packages_were_built == 'true'
198198

199199
steps:
200200
- name: 'Retrieve x86_64 packages'
201-
uses: actions/download-artifact@v3
201+
uses: actions/download-artifact@21e5c25de9cf2ee24742cd3e822327f3be6dd2a3 # v4.1.1
202202
with:
203203
name: packages-x86_64
204204
path: /tmp/artifacts-1/
205205

206206
- name: 'Retrieve aarch64 packages'
207-
uses: actions/download-artifact@v3
207+
uses: actions/download-artifact@21e5c25de9cf2ee24742cd3e822327f3be6dd2a3 # v4.1.1
208208
with:
209209
name: packages-aarch64
210210
path: /tmp/artifacts-2/
@@ -231,19 +231,19 @@ jobs:
231231
name: "Scan packages for CVEs"
232232
runs-on: ubuntu-latest
233233
container:
234-
image: ghcr.io/wolfi-dev/sdk:latest@sha256:110c4bc0a8941606034ee7af12f1197b4a6b6f6434fd4b4bbf61de501e18ffd1
234+
image: ghcr.io/wolfi-dev/sdk:latest@sha256:c2f7cbbfb67ff9cad47e25ff8eb87945a4c5a0a81b2fa9e93a1d9ac6504a8df5
235235
needs: build
236236
if: needs.build.outputs.packages_were_built == 'true'
237237

238238
steps:
239239
- name: 'Retrieve x86_64 packages'
240-
uses: actions/download-artifact@v3
240+
uses: actions/download-artifact@21e5c25de9cf2ee24742cd3e822327f3be6dd2a3 # v4.1.1
241241
with:
242242
name: packages-x86_64
243243
path: /tmp/artifacts-1/
244244

245245
- name: 'Retrieve aarch64 packages'
246-
uses: actions/download-artifact@v3
246+
uses: actions/download-artifact@21e5c25de9cf2ee24742cd3e822327f3be6dd2a3 # v4.1.1
247247
with:
248248
name: packages-aarch64
249249
path: /tmp/artifacts-2/

‎.github/workflows/lint-world.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
group: wolfi-os-builder-${{ matrix.arch }}
3030

3131
container:
32-
image: ghcr.io/wolfi-dev/sdk:latest@sha256:110c4bc0a8941606034ee7af12f1197b4a6b6f6434fd4b4bbf61de501e18ffd1
32+
image: ghcr.io/wolfi-dev/sdk:latest@sha256:c2f7cbbfb67ff9cad47e25ff8eb87945a4c5a0a81b2fa9e93a1d9ac6504a8df5
3333

3434
steps:
3535
- uses: actions/checkout@v4
@@ -149,7 +149,7 @@ jobs:
149149
150150
- name: Upload failed build logs
151151
if: always()
152-
uses: actions/upload-artifact@v3
152+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
153153
with:
154154
path: ./packages/${{ matrix.arch }}/buildlogs/*.log
155155
retention-days: 7

‎.github/workflows/withdraw-packages.yaml‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,25 +24,24 @@ jobs:
2424
run: |
2525
# Copy wolfictl out of the wolfictl image and onto PATH
2626
TMP=$(mktemp -d)
27-
docker run --rm -i -v $TMP:/out --entrypoint /bin/sh ghcr.io/wolfi-dev/sdk:latest@sha256:110c4bc0a8941606034ee7af12f1197b4a6b6f6434fd4b4bbf61de501e18ffd1 -c "cp /usr/bin/wolfictl /out"
27+
docker run --rm -i -v $TMP:/out --entrypoint /bin/sh ghcr.io/wolfi-dev/sdk:latest@sha256:c2f7cbbfb67ff9cad47e25ff8eb87945a4c5a0a81b2fa9e93a1d9ac6504a8df5 -c "cp /usr/bin/wolfictl /out"
2828
echo "$TMP" >> $GITHUB_PATH
2929
30-
- name: 'Authenticate to Google Cloud'
30+
# This is managed here: https://github.com/chainguard-dev/secrets/blob/main/wolfi-dev.tf
31+
- uses: google-github-actions/auth@a6e2e39c0a0331da29f7fd2c2a20a427e8d3ad1f # v2.1.1
3132
id: auth
32-
uses: google-github-actions/auth@f6de81663f7788d05bd15bcce18f0e57f23f0846 # v2.0.1
3333
with:
34-
workload_identity_provider: "projects/618116202522/locations/global/workloadIdentityPools/prod-shared-e350/providers/prod-shared-gha"
35-
service_account: "prod-images-ci@prod-images-c6e5.iam.gserviceaccount.com"
36-
34+
workload_identity_provider: "projects/12758742386/locations/global/workloadIdentityPools/github-pool/providers/github-provider"
35+
service_account: "wolfi-dev@chainguard-github-secrets.iam.gserviceaccount.com"
3736
- uses: google-github-actions/setup-gcloud@5a5f7b85fca43e76e53463acaa9d408a03c98d3a # v2.0.1
3837
with:
39-
project_id: "prod-images-c6e5"
40-
38+
project_id: "chainguard-github-secrets"
4139
- uses: 'google-github-actions/get-secretmanager-secrets@ae0d4054c32840e2ced71207a9df55161ae3debc' # v2.0.0
4240
id: secrets
4341
with:
4442
secrets: |-
45-
token:prod-images-c6e5/melange-signing-key
43+
token:chainguard-github-secrets/wolfi-dev-signing-key
44+
4645
- run: echo "${{ steps.secrets.outputs.token }}" > ./wolfi-signing.rsa
4746
- run: |
4847
sudo mkdir -p /etc/apk/keys
@@ -56,6 +55,15 @@ jobs:
5655
curl https://packages.wolfi.dev/os/$arch/APKINDEX.tar.gz | wolfictl withdraw $(grep -v '\#' withdrawn-packages.txt) --signing-key="${{ github.workspace }}/wolfi-signing.rsa" > $arch/APKINDEX.tar.gz
5756
done
5857
58+
# We use a different GSA for our interaction with GCS.
59+
- uses: google-github-actions/auth@f6de81663f7788d05bd15bcce18f0e57f23f0846 # v2.0.1
60+
with:
61+
workload_identity_provider: "projects/618116202522/locations/global/workloadIdentityPools/prod-shared-e350/providers/prod-shared-gha"
62+
service_account: "prod-images-ci@prod-images-c6e5.iam.gserviceaccount.com"
63+
- uses: google-github-actions/setup-gcloud@5a5f7b85fca43e76e53463acaa9d408a03c98d3a # v2.0.1
64+
with:
65+
project_id: "prod-images-c6e5"
66+
5967
- name: Delete withdrawn packages
6068
run: |
6169
set -euo pipefail

‎Makefile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ MELANGE_OPTS += ${MELANGE_EXTRA_OPTS}
2323

2424
# Enter interactive mode on failure for debug
2525
MELANGE_DEBUG_OPTS += --interactive
26+
MELANGE_DEBUG_OPTS += --package-append apk-tools
2627
MELANGE_DEBUG_OPTS += ${MELANGE_OPTS}
2728

2829
# These are separate from MELANGE_OPTS because for building we need additional
@@ -184,7 +185,7 @@ dev-container:
184185
-v "${PWD}:${PWD}" \
185186
-w "${PWD}" \
186187
-e SOURCE_DATE_EPOCH=0 \
187-
ghcr.io/wolfi-dev/sdk:latest@sha256:110c4bc0a8941606034ee7af12f1197b4a6b6f6434fd4b4bbf61de501e18ffd1
188+
ghcr.io/wolfi-dev/sdk:latest@sha256:c2f7cbbfb67ff9cad47e25ff8eb87945a4c5a0a81b2fa9e93a1d9ac6504a8df5
188189

189190
PACKAGES_CONTAINER_FOLDER ?= /work/packages
190191
TMP_REPOSITORIES_DIR := $(shell mktemp -d)
@@ -249,6 +250,6 @@ dev-container-wolfi:
249250
--mount type=bind,source="${PWD}/local-melange.rsa.pub",destination="/etc/apk/keys/local-melange.rsa.pub",readonly \
250251
--mount type=bind,source="$(TMP_REPOSITORIES_FILE)",destination="/etc/apk/repositories",readonly \
251252
-w "$(PACKAGES_CONTAINER_FOLDER)" \
252-
ghcr.io/wolfi-dev/sdk:latest@sha256:110c4bc0a8941606034ee7af12f1197b4a6b6f6434fd4b4bbf61de501e18ffd1
253+
ghcr.io/wolfi-dev/sdk:latest@sha256:c2f7cbbfb67ff9cad47e25ff8eb87945a4c5a0a81b2fa9e93a1d9ac6504a8df5
253254
@rm "$(TMP_REPOSITORIES_FILE)"
254255
@rmdir "$(TMP_REPOSITORIES_DIR)"

‎asciidoctor.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
package:
22
name: asciidoctor
3-
version: 2.0.20
3+
version: 2.0.21
44
epoch: 0
55
description: A fast, open source text processor and publishing toolchain, written in Ruby, for converting AsciiDoc content to HTML 5, DocBook 5, and other formats.
66
copyright:
@@ -25,7 +25,7 @@ pipeline:
2525
with:
2626
repository: https://github.com/asciidoctor/asciidoctor
2727
tag: v${{package.version}}
28-
expected-commit: e559f0db61f5ad1446602253e0543568ff662bc8
28+
expected-commit: 1ec651ddcf4d2cb49576e7cc62c17ec33f8aa5c1
2929

3030
- uses: ruby/build
3131
with:

‎aws-cli.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
package:
22
name: aws-cli
3-
version: 1.32.45
3+
version: 1.32.46
44
epoch: 0
55
description: "Universal Command Line Interface for Amazon Web Services"
66
copyright:
@@ -33,7 +33,7 @@ pipeline:
3333
- uses: fetch
3434
with:
3535
uri: https://github.com/aws/aws-cli/archive/${{package.version}}.tar.gz
36-
expected-sha256: a86e25e0f3b9fc21f468db6ddd45a4ce6301b28186a6cd658f25befc8634ddb6
36+
expected-sha256: c0452a599bda369e974169263353a4dfdb4903280923e47a319a06ca92c9d210
3737

3838
- runs: |
3939
python3 setup.py build

‎botan.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
package:
22
name: botan
3-
version: 3.2.0
3+
version: 3.3.0
44
epoch: 0
55
description: "Cryptography Toolkit"
66
copyright:
@@ -24,7 +24,7 @@ pipeline:
2424
- uses: git-checkout
2525
with:
2626
repository: https://github.com/randombit/botan
27-
expected-commit: 6f466a2704a31856ebc27451ca861527d3dd00a1
27+
expected-commit: 9074b04c1303a24e2084f8325fa570a5ad4f2478
2828
tag: ${{package.version}}
2929

3030
- name: Configure and build

‎clickhouse.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
package:
22
name: clickhouse
33
version: 24.1.5.6
4-
epoch: 0
4+
epoch: 1
55
description: ClickHouse is the fastest and most resource efficient open-source database for real-time apps and analytics.
66
copyright:
77
- license: Apache-2.0
@@ -56,8 +56,9 @@ pipeline:
5656
- runs: |
5757
cd build
5858
ninja -j $(nproc)
59+
mkdir -p ${{targets.destdir}}/var/lib/clickhouse
60+
mkdir -p ${{targets.destdir}}/var/log/clickhouse-server
5961
DESTDIR=${{targets.destdir}} ninja install
60-
6162
rm -rf ${{targets.destdir}}/usr/lib/debug
6263
6364
- uses: strip
@@ -75,6 +76,15 @@ subpackages:
7576
mkdir -p ${{targets.subpkgdir}}/usr/share/bash-completion/completions
7677
mv ${{targets.destdir}}/usr/share/bash-completion/completions/clickhouse ${{targets.subpkgdir}}/usr/share/bash-completion/completions
7778
79+
- name: "clickhouse-compat"
80+
description: "docker compat for clickhouse"
81+
pipeline:
82+
- runs: |
83+
cd build
84+
install -Dm755 ../docker/server/entrypoint.sh ${{targets.subpkgdir}}/entrypoint.sh
85+
mkdir -p ${{targets.subpkgdir}}/etc/clickhouse-server/config.d/
86+
cp ../docker/server/docker_related_config.xml ${{targets.subpkgdir}}/etc/clickhouse-server/config.d/docker_related_config.xml
87+
7888
update:
7989
enabled: true
8090
github:

0 commit comments

Comments
 (0)