feat(image): support multi-binary Go release units - #69
Merged
Conversation
Melange copies work/sources/<apkarch>/<binary-name> rather than a shared application file.
image verify loads expected names from the v2 projection, so the builder no longer shuttles .result.binary through RELEASE_BINARY.
Consumers install each staged file by its GoReleaser name. The previous shared application filename is a migration from the prior unit.
Select every linux/{amd64,arm64} Binary, stage each under its real name,
and verify all usr/bin entries in one layer pass. Single-binary consumers
are N=1 under the v2 schemas.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Go release unit previously supported exactly one application binary:
release-cli stagefailed on a duplicatelinux/<arch>Binary record, the OCI leg staged one file assources/<arch>/application, and the verifier hardcoded one entrypoint and one layer entry. This blocked multi-binary consumers (first case: componere/incus-spire-attestor, a SPIRE plugin pair shippingincus-agent+incus-serverin one carrier image).This PR generalizes the unit to a named binary set per platform:
goprof.SelectBinariesselects everylinux/{amd64,arm64}Binary record, rejects duplicate (arch, name) pairs, and requires identical nonempty name sets across both architectures.release.dev/oci-build-inputs/v2: per name, exactly one amd64 and one arm64 entry.image build(release.dev/image-build/v2) stages each binary aswork/sources/<apkarch>/<binary-name>(theapplicationsentinel is gone);canonical-binaries.sha256lists every staged file;BuildResult.BinariesreplacesBinary.image verify(release.dev/image-verify/v2) derives the expected name set fromwork/sources(same-set validation), hashes ALLusr/bin/<name>entries in one streaming pass per platform layer (each exactly once, regular, 0755, uid/gid 0, size-bounded), and requires the config Entrypoint to be[/usr/bin/<name>]for some staged name. The--binaryflag andRELEASE_BINARYextraction are removed.melange.yamlinstalls stagedrelease-cliby name; docs (adopt guide, reference, tutorial, example) document the by-name contract, the entrypoint rule, and theapplication→<binary-name>migration.Migration for existing adopters
At re-pin, change the melange pipeline from
applicationto the GoReleaser binary name (e.g. incusos-builder:install ... incusos-builder). Single-binary projects are otherwise unchanged (N=1).Validation
moon run root:checkpasses (format, lint, mocks, build, full test suite). New table tests cover N=1 and N=2 selection, duplicate (arch,name), asymmetric name sets, entrypoint not in set, missing/duplicate layer entries, and checksum ordering.