chore(deps): update konflux references - #2920
Conversation
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
WalkthroughBoth Tekton pipelines add Estimated code review effort: 3 (Moderate) | ~20 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (2 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 57b47576-3f05-4bfd-9b67-add7cdecfc34
📒 Files selected for processing (2)
.tekton/compliance-backend-pull-request.yaml.tekton/compliance-backend-push.yaml
| - name: source-date-epoch | ||
| type: string | ||
| default: '' | ||
| description: Sets the image created time and the SOURCE_DATE_EPOCH build argument. On its own, it does not change file timestamps inside the layers (set rewrite-timestamp to "true" for that). Leave empty to keep the actual build time. | ||
| - name: rewrite-timestamp | ||
| type: string | ||
| default: 'false' | ||
| description: When "true", clamp file modification times in the image layers to at most source-date-epoch. Does nothing unless source-date-epoch is set. | ||
| - name: omit-history | ||
| type: string | ||
| default: 'false' | ||
| description: When "true", omit the build history (history timestamps, layer metadata, etc.) from the resulting image. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
for f in .tekton/compliance-backend-pull-request.yaml .tekton/compliance-backend-push.yaml; do
echo "=== $f: parameter declarations ==="
sed -n '115,145p' "$f"
echo "=== $f: source-date-epoch and rewrite-timestamp usages ==="
rg -n -C 5 'source-date-epoch|rewrite-timestamp|omit-history|commit-timestamp|clone-repository' "$f"
done
echo "=== clone-repository result declarations and task references ==="
rg -n -C 8 'name: clone-repository|commit-timestamp|results:' .tektonRepository: RedHatInsights/compliance-backend
Length of output: 15873
🏁 Script executed:
#!/bin/bash
set -eu
for f in .tekton/compliance-backend-pull-request.yaml .tekton/compliance-backend-push.yaml; do
echo "=== $f: clone and build-image-index task definitions ==="
sed -n '145,275p' "$f"
done
echo "=== repository-wide commit-timestamp references ==="
rg -n -S 'commit-timestamp|SOURCE_DATE_EPOCH|REWRITE_TIMESTAMP|OMIT_HISTORY' . --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' || true
echo "=== pipeline parameter defaults and substitutions ==="
rg -n -C 3 'default:.*\\$\\(|\\$\\(tasks\\..*results|params.source-date-epoch' .tektonRepository: RedHatInsights/compliance-backend
Length of output: 9449
🌐 Web query:
Konflux reproducible container builds ADR 0069 source-date-epoch commit-timestamp rewrite-timestamp Tekton
💡 Result:
Architecture Decision Record (ADR) 0069, "Reproducible Container Builds in Konflux," outlines the strategy for ensuring that identical source commits produce consistent container image digests within the Konflux CI platform [1][2]. The core of this strategy relies on addressing non-deterministic timestamps and file modification times (mtimes) during the build process [3]. To achieve bit-wise reproducibility, Konflux employs the following mechanisms: 1. SOURCE_DATE_EPOCH: This standardized environment variable [4][5] is propagated to the build environment [3]. The Konflux pipeline extracts the git commit timestamp from the source repository and wires it to the SOURCE_DATE_EPOCH parameter [3]. This ensures that embedded timestamps in the container metadata (such as the "Created" field) are clamped to the commit time rather than the actual build time [3][5]. 2. --rewrite-timestamp: Simply setting SOURCE_DATE_EPOCH is often insufficient for full bit-wise reproducibility because build tools may still preserve original file mtimes inside image layers [3]. Enabling the --rewrite-timestamp option (typically used with tools like buildah) forces these timestamps to be clamped to the value provided by SOURCE_DATE_EPOCH, ensuring that the resulting layer contents are deterministic [3][4]. 3. Tekton Integration: These parameters are configured within the Tekton-based pipelines that run on Konflux [3][6]. The build-container tasks are updated to accept and utilize these variables [3]. Additionally, Konflux may use specific build-side options (such as those being integrated into the konflux-build-cli) to properly handle label and layer generation [2]. ADR 0069 also identifies further requirements for holistic reproducibility, such as sorting multi-arch manifest indexes to prevent non-deterministic ordering of image manifests [2][7]. Beyond these technical build-time flags, Konflux also encourages the use of hermetic builds (via tools like Hermeto) to ensure dependencies are pinned and fetched deterministically [8], and it provides guidance on using commit-based timestamps versus actual build-time timestamps for image labels to balance reproducibility needs with operational requirements [9].
Citations:
- 1: https://konflux-ci.dev/architecture/ADR/0069-reproducible-container-builds/
- 2: Add ADR-0069: Reproducible Container Builds in Konflux konflux-ci/architecture#360
- 3: Use commit-timestamp in tasks in pursuit of reproducible builds konflux-ci/build-definitions#1268
- 4: https://reproducible-builds.org/docs/source-date-epoch/
- 5: https://reproducible-builds.org/specs/source-date-epoch/
- 6: https://konflux-ci.dev/docs/building/
- 7: https://konflux-ci.dev/architecture/ADR/0070-dual-compression-for-container-builds/
- 8: https://konflux-ci.dev/docs/building/prefetching-dependencies/
- 9: https://konflux-ci.dev/docs/building/labels-and-annotations/
🌐 Web query:
"git-clone-oci-ta" "commit-timestamp" Konflux
💡 Result:
In Konflux, git-clone-oci-ta is a specialized variant of the standard git-clone Tekton Task designed to support Trusted Artifacts [1]. It enables the secure sharing of source code files between Pipeline Tasks via OCI storage rather than traditional Persistent Volume Claims [1]. The commit-timestamp result is a piece of metadata provided by the git-clone-oci-ta Task that represents the timestamp of the Git commit currently checked out [2]. This result is primarily used to facilitate reproducible container builds and to provide accurate metadata for container images [3][4]. By passing this value into the SOURCE_DATE_EPOCH parameter of subsequent build Tasks (such as buildah-oci-ta), the build process can clamp file modification times and metadata timestamps to the commit time, which helps ensure that identical source code produces identical (bit-wise reproducible) container image digests [4]. Additionally, the commit-timestamp is often used in labeling and tagging strategies, such as setting the build-date label or creating unique image tags based on the time the source was committed [5][3]. Top Results: [6][1][5][3][4][2]
Citations:
- 1: https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts/
- 2: https://github.com/konflux-ci/build-definitions/blob/main/pipelines/docker-build/README.md
- 3: https://konflux-ci.dev/docs/building/labels-and-annotations/
- 4: Use commit-timestamp in tasks in pursuit of reproducible builds konflux-ci/build-definitions#1268
- 5: https://konflux-ci.dev/docs/patterns/mapping-tags-to-labels/
- 6: https://github.com/konflux-ci/build-definitions/blob/main/pipelines/docker-build-oci-ta/README.md
🌐 Web query:
"buildah-oci-ta" "SOURCE_DATE_EPOCH" "REWRITE_TIMESTAMP"
💡 Result:
The --source-date-epoch and --rewrite-timestamp flags are features introduced in Buildah (v1.41.0) to facilitate reproducible container builds by mitigating non-determinism in image creation [1][2][3]. --source-date-epoch seconds This flag sets the created timestamp for the built image to the specified number of seconds since the Unix epoch [4][5]. It defaults to the value of the SOURCE_DATE_EPOCH environment variable if set, or the current time otherwise [5][6]. When used, it also sets a SOURCE_DATE_EPOCH build argument and forces output from the --output flag to bear this timestamp [4][1][7]. Additionally, when this or the --timestamp flag is enabled, Buildah uses fixed values for hostnames and container IDs during the build process to ensure greater determinism [8]. --rewrite-timestamp This flag works in conjunction with --source-date-epoch [1][7]. When enabled, it "clamps" the timestamps of newly added layer content, ensuring that no file or directory bears a timestamp later than the value provided by --source-date-epoch [4][5][9]. If no --source-date-epoch is provided, this flag has no effect [1][7]. To achieve a reproducible build, these flags are typically used together in the build command (e.g., buildah bud --source-date-epoch=${SOURCE_DATE_EPOCH} --rewrite-timestamp...) [9][10]. Using these flags allows for identical container images to be generated from the same inputs at different times, resulting in consistent image digests [4][9].
Citations:
- 1: build: add --source-date-epoch and --rewrite-timestamp flags podman-container-tools/buildah#6208
- 2: https://buildah.io/releases/2025/07/21/Buildah-version-v1.41.0.html
- 3: commit: add --source-date-epoch and --rewrite-timestamp flags podman-container-tools/buildah#6189
- 4: https://github.com/containers/buildah/blob/main/docs/buildah-build.1.md
- 5: https://manpages.debian.org/experimental/buildah/buildah-build.1.en.html
- 6: https://manpages.debian.org/unstable/buildah/buildah-build.1.en.html
- 7: podman-container-tools/buildah@865dace
- 8: build: --source-date-epoch/--timestamp use static hostname/cid podman-container-tools/buildah#6211
- 9: https://docs.redhat.com/zh-cn/documentation/red_hat_enterprise_linux/10/html/building_running_and_managing_containers/working-with-reproducible-container-builds
- 10: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/building_running_and_managing_containers/introduction-to-reproducible-container-builds_building-running-and-managing-containers
🌐 Web query:
Tekton variable substitution default fallback task result parameter syntax
💡 Result:
In Tekton, there is no built-in "fallback" or "default" syntax directly within the variable substitution string (e.g.,
Citations:
- 1: Suggest of variable substituting tektoncd/pipeline#3718
- 2: TEP-0048: default results tektoncd/pipeline#9653
- 3: https://tektoncd-pipeline.mintlify.app/examples/tasks/task-with-params
- 4: https://tektoncd-pipeline.mintlify.app/concepts/parameters
🏁 Script executed:
#!/bin/bash
set -eu
urls=(
"https://raw.githubusercontent.com/konflux-ci/build-definitions/main/tasks/git-clone-oci-ta/README.md"
"https://raw.githubusercontent.com/konflux-ci/build-definitions/main/tasks/buildah-oci-ta/README.md"
"https://raw.githubusercontent.com/konflux-ci/build-definitions/main/pipelines/docker-build-oci-ta/README.md"
"https://raw.githubusercontent.com/konflux-ci/build-definitions/main/pipelines/docker-build/README.md"
)
for url in "${urls[@]}"; do
echo "=== $url ==="
curl -fsSL "$url" | rg -n -C 4 'commit-timestamp|SOURCE_DATE_EPOCH|REWRITE_TIMESTAMP|rewrite-timestamp|source-date-epoch' || true
done
echo "=== git-clone-oci-ta references in build-definitions ==="
curl -fsSL "https://api.github.com/repos/konflux-ci/build-definitions/git/trees/main?recursive=1" |
jq -r '.tree[].path' |
rg 'git-clone-oci-ta|buildah-oci-ta|docker-build'Repository: RedHatInsights/compliance-backend
Length of output: 13472
🏁 Script executed:
#!/bin/bash
set -u
echo "=== upstream docker-build-oci-ta directory links ==="
curl -fsSL "https://github.com/konflux-ci/build-definitions/tree/main/pipelines/docker-build-oci-ta" |
rg -o 'href="[^"]+"' |
sed 's/^href="//; s/"$//' |
rg 'docker-build-oci-ta|README|yaml' | sort -u || true
echo "=== upstream docker-build-oci-ta YAML candidates ==="
for path in \
pipelines/docker-build-oci-ta/docker-build-oci-ta.yaml \
pipelines/docker-build-oci-ta/pipeline.yaml \
pipelines/docker-build-oci-ta/docker-build-oci-ta.yml \
tasks/git-clone-oci-ta/0.2/git-clone-oci-ta.yaml \
tasks/buildah-oci-ta/0.10/buildah-oci-ta.yaml; do
url="https://raw.githubusercontent.com/konflux-ci/build-definitions/main/$path"
status=$(curl -L -s -o /tmp/upstream-file -w '%{http_code}' "$url")
echo "$status $path"
if [ "$status" = 200 ]; then
rg -n -C 5 'commit-timestamp|SOURCE_DATE_EPOCH|REWRITE_TIMESTAMP|source-date-epoch' /tmp/upstream-file || true
fi
done
echo "=== local occurrences, including callers ==="
rg -n -S 'source-date-epoch|commit-timestamp' . --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' || trueRepository: RedHatInsights/compliance-backend
Length of output: 2666
🌐 Web query:
site:github.com/konflux-ci/build-definitions "commit-timestamp" "source-date-epoch"
💡 Result:
SOURCE_DATE_EPOCH is a standardized environment variable used in software development to enable reproducible builds by providing a single, fixed point in time for build artifacts [1][2][3]. In the context of CI/CD pipelines (such as those used in Konflux or other container-building workflows), commit-timestamp and SOURCE_DATE_EPOCH are often linked to ensure that builds derived from a specific version of source code are deterministic [1]. 1. Function: By setting SOURCE_DATE_EPOCH to the Unix timestamp of the relevant git commit, build tools can use this value to normalize timestamps in generated files (such as container image layers, file modification times, and image metadata) [1][2]. 2. Reproducibility: Without a fixed timestamp, builds performed at different times will generate different binary outputs (e.g., different image digests) due to variations in creation dates or file mtimes [1]. Using the commit-timestamp as the SOURCE_DATE_EPOCH ensures that identical source code produces bit-identical artifacts [1]. 3. Workflow Usage: In many automated build tasks, the commit-timestamp is extracted from the git repository during checkout and then passed as the value for the SOURCE_DATE_EPOCH environment variable [1][2]. Tools like buildah or other OCI image builders use this variable to clamp file modification times (often when paired with flags like --rewrite-timestamp) and set the creation time of images [1][2][3]. In summary, commit-timestamp provides the reference time, and SOURCE_DATE_EPOCH acts as the standard interface used by build tools to adopt that reference time for deterministic, reproducible results [1].
Citations:
- 1: Use commit-timestamp in tasks in pursuit of reproducible builds konflux-ci/build-definitions#1268
- 2: https://github.com/konflux-ci/build-definitions/blob/main/pipelines/fbc-builder/README.md
- 3: https://github.com/konflux-ci/build-definitions/blob/main/pipelines/docker-build-oci-ta/README.md
🏁 Script executed:
python3 - <<'PY'
from pathlib import Path
import re
files = [
Path(".tekton/compliance-backend-pull-request.yaml"),
Path(".tekton/compliance-backend-push.yaml"),
]
for path in files:
text = path.read_text()
assert re.search(
r"- name: source-date-epoch\s+type: string\s+default: ''",
text,
), path
assert re.search(
r"- name: rewrite-timestamp\s+type: string\s+default: 'false'",
text,
), path
assert "- name: SOURCE_DATE_EPOCH\n value: $(params.source-date-epoch)" in text, path
assert "value: $(tasks.clone-repository.results.commit-timestamp)" not in text, path
assert "value: git-clone-oci-ta" in text, path
assert "task-git-clone-oci-ta:0.2.5@" in text, path
print(f"{path}: empty epoch default, rewrite disabled by default, build receives the parameter, no timestamp fallback")
print("Both manifests expose the same unresolved fallback.")
PYRepository: RedHatInsights/compliance-backend
Length of output: 511
Use the clone commit timestamp as the SOURCE_DATE_EPOCH fallback in both pipelines.
When source-date-epoch is empty and rewrite-timestamp is true, ensure build-container receives $(tasks.clone-repository.results.commit-timestamp). Preserve an explicitly supplied epoch. Resolve this choice before invoking buildah-oci-ta, because Tekton has no inline conditional fallback. Without this fallback, rewrite-timestamp has no effect.
📍 Affects 2 files
.tekton/compliance-backend-pull-request.yaml#L127-L138(this comment).tekton/compliance-backend-push.yaml#L111-L122
| - name: SOURCE_DATE_EPOCH | ||
| value: $(params.source-date-epoch) | ||
| - name: REWRITE_TIMESTAMP | ||
| value: $(params.rewrite-timestamp) | ||
| - name: OMIT_HISTORY | ||
| value: $(params.omit-history) |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
for f in .tekton/compliance-backend-pull-request.yaml .tekton/compliance-backend-push.yaml; do
echo "===== $f: parameter and task sections ====="
rg -n -C 5 'source-date-epoch|rewrite-timestamp|omit-history|sbom|signature|attestation|dockerfile|artifact|referrer|digest' "$f" || true
done
echo "===== related tracked files ====="
git ls-files | rg '(^|/)(\.tekton|tekton|pipeline|task|sbom|attest|dockerfile|compliance)' | head -200
echo "===== repository-wide consumers and artifact terms ====="
rg -n -i 'source-date-epoch|rewrite-timestamp|omit-history|secondary.artifact|oci referrer|referrer|sbom|signature|attestation|dockerfile' --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' . | head -300Repository: RedHatInsights/compliance-backend
Length of output: 27083
🏁 Script executed:
#!/bin/bash
set -eu
for f in .tekton/compliance-backend-pull-request.yaml .tekton/compliance-backend-push.yaml; do
echo "===== $f: tasks 120-540 ====="
sed -n '120,540p' "$f"
done
echo "===== remote references in the repository ====="
rg -n 'pipeline-docker-build-oci-ta|task-show-sbom|task-push-dockerfile-oci-ta|build-container|build-image-index' .tekton README.md AGENTS.md 2>/dev/null || true
echo "===== ADR source candidates ====="
for u in \
"https://konflux-ci.dev/architecture/ADR/0069-reproducible-container-builds/" \
"https://raw.githubusercontent.com/konflux-ci/architecture/main/ADR/0069-reproducible-container-builds.md" \
"https://raw.githubusercontent.com/konflux-ci/architecture/main/ADR/0069-reproducible-container-builds.adoc"; do
echo "URL: $u"
curl -LfsS --max-time 20 "$u" 2>/dev/null | head -200 || true
done
echo "===== public task source candidates ====="
for u in \
"https://api.github.com/search/code?q=task-push-dockerfile-oci-ta+org%3Akonflux-ci" \
"https://api.github.com/search/code?q=task-show-sbom+org%3Akonflux-ci"; do
echo "URL: $u"
curl -LfsS --max-time 20 "$u" 2>/dev/null | head -80 || true
doneRepository: RedHatInsights/compliance-backend
Length of output: 50389
🏁 Script executed:
#!/bin/bash
set -eu
echo "===== ADR secondary-artifact references ====="
curl -LfsS --max-time 20 \
https://raw.githubusercontent.com/konflux-ci/architecture/main/ADR/0069-reproducible-container-builds.md |
rg -n -C 8 'secondary|SBOM|attestation|signature|collision|referrer|digest|tag' | head -240
echo "===== build-definitions repository paths ====="
curl -LfsS --max-time 30 \
'https://api.github.com/repos/konflux-ci/build-definitions/git/trees/main?recursive=1' |
jq -r '.tree[]?.path' |
rg -i 'show.?sbom|push.?dockerfile|dockerfile.*oci|sbom|attest|signature' | head -240
echo "===== GitHub repository search via commits and contents ====="
for p in \
"task/show-sbom/0.2/show-sbom.yaml" \
"task/push-dockerfile-oci-ta/0.3.1/push-dockerfile-oci-ta.yaml" \
"tasks/show-sbom/0.2/show-sbom.yaml" \
"tasks/push-dockerfile-oci-ta/0.3.1/push-dockerfile-oci-ta.yaml"; do
u="https://raw.githubusercontent.com/konflux-ci/build-definitions/main/$p"
echo "URL: $u"
curl -LfsS --max-time 20 "$u" 2>/dev/null | head -160 || true
doneRepository: RedHatInsights/compliance-backend
Length of output: 29671
🏁 Script executed:
#!/bin/bash
set -eu
registry="quay.io"
repo="konflux-ci/tekton-catalog"
for ref in \
"task-push-dockerfile-oci-ta@sha256:5393bada94051f02aa971ff773b130928e01ac595b9ce3bbbd69899751ed8222" \
"pipeline-docker-build-oci-ta@sha256:0000000000000000000000000000000000000000000000000000000000000000"; do
name="${ref%@*}"
digest="${ref#*@}"
echo "===== $name $digest ====="
curl -LfsS --max-time 30 \
-H 'Accept: application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.index.v1+json' \
"https://${registry}/v2/${repo}/${name}/manifests/${digest}" |
jq '{schemaVersion,mediaType,config,layers,manifests}'
doneRepository: RedHatInsights/compliance-backend
Length of output: 1142
🏁 Script executed:
#!/bin/bash
set -eu
registry="quay.io"
repo="konflux-ci/tekton-catalog"
name="task-push-dockerfile-oci-ta"
digest="sha256:5393bada94051f02aa971ff773b130928e01ac595b9ce3bbbd69899751ed8222"
manifest="$(curl -LfsS --max-time 30 \
-H 'Accept: application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json' \
"https://${registry}/v2/${repo}/${name}/manifests/${digest}")"
echo "===== config ====="
config_digest="$(printf '%s' "$manifest" | jq -r '.config.digest')"
curl -LfsS --max-time 30 "https://${registry}/v2/${repo}/${name}/blobs/${config_digest}" | jq .
echo "===== layer file list ====="
layer_digest="$(printf '%s' "$manifest" | jq -r '.layers[0].digest')"
curl -LfsS --max-time 30 "https://${registry}/v2/${repo}/${name}/blobs/${layer_digest}" | tar -tzf -
echo "===== relevant task content ====="
curl -LfsS --max-time 30 "https://${registry}/v2/${repo}/${name}/blobs/${layer_digest}" |
tar -xOzf - 2>/dev/null |
rg -n -C 5 'dockerfile|IMAGE_DIGEST|IMAGE_URL|oci|tag|referrer|cosign|oras|skopeo|push' || trueRepository: RedHatInsights/compliance-backend
Length of output: 3853
🏁 Script executed:
#!/bin/bash
set -eu
for f in .tekton/compliance-backend-pull-request.yaml .tekton/compliance-backend-push.yaml; do
echo "===== $f: header and finalizers ====="
sed -n '1,120p' "$f"
done
echo "===== konflux-build-cli branch ====="
git ls-remote --symref https://github.com/konflux-ci/konflux-build-cli.git HEAD refs/heads/main refs/heads/master 2>/dev/null | head -10
echo "===== konflux-build-cli source candidates ====="
python3 - <<'PY'
import io, json, re, subprocess, tarfile, urllib.request
repo = "https://github.com/konflux-ci/konflux-build-cli"
branch = "main"
try:
raw = subprocess.check_output(
["git", "ls-remote", "--symref", repo + ".git", "HEAD"],
text=True, stderr=subprocess.DEVNULL)
m = re.search(r"refs/heads/([^\s]+)", raw)
if m:
branch = m.group(1)
except Exception:
pass
url = f"https://codeload.github.com/konflux-ci/konflux-build-cli/tar.gz/refs/heads/{branch}"
data = urllib.request.urlopen(url, timeout=30).read()
tf = tarfile.open(fileobj=io.BytesIO(data), mode="r:gz")
matches = []
for member in tf.getmembers():
if not member.isfile():
continue
name = member.name.lower()
if any(x in name for x in ("containerfile", "dockerfile", "push-container", "push_container")):
text = tf.extractfile(member).read().decode("utf-8", "replace")
matches.append((member.name, text))
print("branch:", branch)
print("matches:", [n for n, _ in matches])
for name, text in matches:
hits = [f"{i+1}:{line}" for i, line in enumerate(text.splitlines())
if re.search(r"tag.?suffix|image.?digest|dockerfile|containerfile|referrer|oras|sha256[-_]", line, re.I)]
if hits:
print(f"--- {name} ---")
print("\n".join(hits[:160]))
PYRepository: RedHatInsights/compliance-backend
Length of output: 12868
🏁 Script executed:
#!/bin/bash
set -eu
echo "===== konflux-build-cli source candidates ====="
curl -ksLf --max-time 40 \
https://codeload.github.com/konflux-ci/konflux-build-cli/tar.gz/refs/heads/main |
python3 - <<'PY'
import io, re, sys, tarfile
data = sys.stdin.buffer.read()
tf = tarfile.open(fileobj=io.BytesIO(data), mode="r:gz")
for member in tf.getmembers():
if not member.isfile():
continue
name = member.name.lower()
if any(x in name for x in ("containerfile", "dockerfile", "push-container", "push_container")):
text = tf.extractfile(member).read().decode("utf-8", "replace")
hits = [f"{i+1}:{line}" for i, line in enumerate(text.splitlines())
if re.search(r"tag.?suffix|image.?digest|dockerfile|containerfile|referrer|oras|cosign|sha256[-_]|push-container", line, re.I)]
if hits:
print(f"--- {member.name} ---")
print("\n".join(hits[:200]))
PY
echo "===== deterministic collision check ====="
python3 - <<'PY'
def dockerfile_tag(image_digest, suffix=".dockerfile"):
# This models the task contract: IMAGE_DIGEST constructs the artifact tag,
# and TAG_SUFFIX supplies the artifact suffix.
return f"sha256-{image_digest.removeprefix('sha256:')}{suffix}"
digest = "sha256:" + "a" * 64
first = dockerfile_tag(digest)
second = dockerfile_tag(digest)
print({"first": first, "second": second, "collision": first == second})
assert first == second
PYRepository: RedHatInsights/compliance-backend
Length of output: 1466
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import io, json, subprocess, tarfile
registry = "quay.io"
repo = "konflux-ci/tekton-catalog"
name = "task-push-dockerfile-oci-ta"
digest = "sha256:5393bada94051f02aa971ff773b130928e01ac595b9ce3bbbd69899751ed8222"
def curl(url, *args):
return subprocess.check_output(
["curl", "-ksLf", "--max-time", "30", *args, url]
)
manifest = json.loads(curl(
f"https://{registry}/v2/{repo}/{name}/manifests/{digest}",
"-H", "Accept: application/vnd.docker.distribution.manifest.v2+json"
))
layer = manifest["layers"][0]["digest"]
bundle = curl(f"https://{registry}/v2/{repo}/{name}/blobs/{layer}")
tf = tarfile.open(fileobj=io.BytesIO(bundle), mode="r:gz")
task = json.loads(tf.extractfile(tf.getmembers()[0]).read())
params = {p["name"]: p for p in task["spec"]["params"]}
step_args = task["spec"]["steps"][1]["args"]
assert "IMAGE_DIGEST" in params
assert "used to construct the tag" in params["IMAGE_DIGEST"]["description"]
assert "--image-digest" in step_args
assert "--tag-suffix" in step_args
suffix = params["TAG_SUFFIX"]["default"]
assert suffix == ".dockerfile"
def artifact_tag(primary_digest):
return "sha256-" + primary_digest.removeprefix("sha256:") + suffix
digest_a = "sha256:" + "a" * 64
digest_b = "sha256:" + "a" * 64
tag_a = artifact_tag(digest_a)
tag_b = artifact_tag(digest_b)
print({
"image_digest_contract": params["IMAGE_DIGEST"]["description"],
"tag_suffix": suffix,
"tag_a": tag_a,
"tag_b": tag_b,
"same_digest_same_tag": tag_a == tag_b,
})
assert tag_a == tag_b
PYRepository: RedHatInsights/compliance-backend
Length of output: 536
Make Dockerfile artifact tags collision-safe in both pipelines.
push-dockerfile-oci-ta:0.3.1 derives the .dockerfile tag from IMAGE_DIGEST. Reproducible runs with the same digest overwrite the same artifact. Use a per-run identity or OCI referrers. Apply the same contract to SBOM, signature, and attestation publishers.
.tekton/compliance-backend-pull-request.yaml#L249-L254.tekton/compliance-backend-push.yaml#L226-L231
📍 Affects 2 files
.tekton/compliance-backend-pull-request.yaml#L249-L254(this comment).tekton/compliance-backend-push.yaml#L226-L231
This PR contains the following updates:
0.3→0.3.10.10→0.10.70.3→0.3.20.3→0.3.1e78d0d3→0ccc6882e5ebe0→27c97600.2→0.2.50.4→0.4.30.3→0.6.00.3→0.3.10.2→0.2.1f6a115e→61b27e6918327b→eba24f54961c44→eb9d5390.1→0.22dd5b3e→6081c41Release Notes
konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-build-image-index)
v0.3.1Fixed
SBOM_SKIP_VALIDATIONinto the step environment so the create-sbom step honors the parameter.The parameter did nothing before. Now it works as expected.
konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)
v0.3.2Changed
quay.io/konflux-ci/oras:latestimage withquay.io/konflux-ci/task-runner:1.5.0in the oci-attach-report step.Added
v0.3.1Added
konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)
v0.6.0v0.5.0v0.4.1Fixed
trusted-cavolume in theuse-trusted-artifactandcreate-trusted-artifactsteps.Previously, the mount was missing, which means the task did not support container registries
with certificates signed by a private/self-signed CA.
v0.4.0v0.3.2enable-package-registry-proxyparameter to enable use of the package registry proxy when prefetching dependencies.SERVICE_CA_TRUST_CONFIG_MAP_NAMEandSERVICE_CA_TRUST_CONFIG_MAP_KEYparameters to mount the OpenShift service CA for verifying TLS connections to in-cluster services such as the package registry proxy.Configuration
📅 Schedule: (UTC)
* 5-23 * * 6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.