Repository navigation
Conversation
…Ls from the pins QEMU's and e2fsprogs' builders installed whatever Alpine's mirror served on the day of the build: the static libraries linked into released binaries were the mirror's, not a commit's. Each part now has an apk.list (what it asks for) and an apk.lock (every package installed, dependencies included, at a version), written by task apk:lock from a fresh install on the pinned Alpine and read back by hack/apklock. A pin the mirror has dropped fails a cold build at apk add; the fix is task apk:lock and the diff is the review. The SBOM's sources component now carries QEMU's, qboot's and the kernel's patches as pedigree, and SOURCES names the URL each tarball's sha256 was checked against (go tool versions url), not one written in hack/release. go-tools 99d7447 for versions url and sbom pins -patches. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Rebuilt locally with the locks: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the spin-machine gaps in the supply-chain track (S2).
qemu/apk.listande2fsprogs/apk.listsay what each builder installs;qemu/apk.lock(150 packages) ande2fsprogs/apk.lock(75) pin every installed package, dependencies included.task apk:lockwrites them from a freshapk addon the pinned Alpine, read back by the newhack/apklock. The Dockerfiles install the list held to the lock.TestEachListIsLockedrefuses a list name the lock does not pin (ninjais listed assamurai, the package that provides it).sbom pins -patchesputs QEMU's, qboot's and the kernel's patches (name + hash) in their components.go tool versions url, so they are the URLs whose sha256 the build checked; the kernel's now names git.kernel.org (7.3-rc5 was never on cdn.kernel.org).Operational note: a cold build fails at
apk addonce Alpine drops a pinned version from its mirror. The fix istask apk:lock, and the lock diff is the review; a new lock is a new QEMU build, sohack/fingerprint-diffreports it in the release.Verified locally:
task lint,task test,task mutate(0 survived),task e2fsprogs:build+ verify with the lock. Today's qemu lock is identical to the cached builder's database; the QEMU rebuild with the lock is running and I'll add its result here.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need.