Repository navigation
Pick up ca-certificates 20250419+deb13u1 and remove what the image doesn't use - #323
Merged
Merged
Conversation
Moving the base to trixie-20261005-slim rebuilds the cached layer that installs ca-certificates, so it gets 20250419+deb13u1 (DSA-6572-1). AWS_CA_BUNDLE makes awscli use the system's CA bundle instead of the one it ships.
Nothing has called gcloud or gsutil since the docs scripts were removed in e70a235, so google-cloud-cli goes, with gnupg and apt-transport-https, which were only there to install it, and etc/boto, which only gsutil read. The key file cosign signs with moves from /boto to /gcp. build-essential, libffi-dev, libssl-dev and python3-dev were for pip install awscli, and awscli is the Debian package now. No job script runs zip, and tar and gzip are part of the base image. In the build stage, no dependency is a git checkout or compiles C, so git and build-essential go too. utils.sh lost its last caller in e70a235, and the prepare_*_builds_text.exs scripts rebuilt builds.txt from S3 listings, which Bob.Artifacts generates from the database now.
ericmj
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moving the base to
trixie-20261005-slimrebuilds the cached layer that installsca-certificates, so it gets 20250419+deb13u1 (DSA-6572-1). Also bumps castore to 1.0.22, andAWS_CA_BUNDLEmakes awscli use the system's CA bundle instead of the one it ships.The second commit removes what the image installs and nothing runs. That's google-cloud-cli, since nothing has called gcloud or gsutil since e70a235, along with gnupg, apt-transport-https and
etc/boto, which were only there for it. It also drops the build-essential and-devpackages thatpip install awsclineeded before awscli was the Debian package, zip, and the build stage's git and build-essential, since no dependency is a git checkout or compiles C.utils.shand theprepare_*_builds_text.exsscripts are deleted; nothing calls them, andBob.Artifactsgenerates builds.txt from the database. The key file cosign signs with moves from/bototo/gcp. The image goes from 2.14 GB to 0.77 GB, and every command the job scripts run is still in it.