Enhancement: Support specifying package versions by digest

[zong-zhe]

Enhancement

Currently, KPM supports OCI Registry only through OCI Tag. In the future, KPM can continue to supports the OCI digest.

[Gmin2]

Hi @zong-zhe can i start working on the issue , and can you provide some more information around the issue, Thanks..

[zong-zhe]

Hi @Gmin2 😄

Welcome!

This part supports the extension of KCL OCI registry dependency. OCI registry supports the download of the KCL tripartite library from the OCI registry through two flags, Tag and digest. It is similar to Git repository, Just as you can download content via the branch name, tag, and commit flags, kpm currently only supports interaction with OCI registry via Tag. We need to extend the functionality of kpm to enable it to interact with OCI registry using digest.

The APIs in this package use Source as input.

Source is here:

kpm/pkg/downloader/source.go

Line 36 in 742130e

type Source struct {

You can first add a field called digest to the OCI in source.

Oci is here:

kpm/pkg/downloader/source.go

Line 51 in 742130e

type Oci struct {

Then step by step try to use this field in the logic inside kpm to download the KCL package in OCI Registry.

This function may involve a lot of changes; you can split this function into multiple PRs. The first step is to make kcl.mod and kcl.mod.lock. These two files support digest. Andf feel free to ask questions 😄

[7h3-3mp7y-m4n]

If the issue is stale then I would love to work on this, Thanks!

[zong-zhe]

Hi @7h3-3mp7y-m4n 😄

I can provide you with some more details.

KCL's package management tools currently support interaction with the OCI registry and use tag to specify the version of the OCI package.

More information:

• https://www.kcl-lang.io/docs/0.10/user_docs/guides/package-management/how-to/kpm_oci
• https://www.kcl-lang.io/docs/tools/cli/package-management/command-reference/add

From the above document, you can get at least two points:

1. You can use commands like this to interact with three-party dependencies in OCI registry:

Take add as example

kcl mod add k8s:1.27

1.27 is the tag of the kcl package in oci registry.

2. You can add something like this to kcl.mod to add dependencies from OCI registry to your current kcl project

Here is a simple example

[dependencies]
k8s = "1.27"

1.27 is the tag of the kcl package in oci registry.

But, OCI registry supports not only tag but also digest, the OCI artifact can be referenced using a tag or a digest. Therefore, we need to extend this functionality so that the KCL package management tool can retrieve the tripartite dependencies from the OCI registry via digest.

The work you need to do will probably require the following parts:

1. Extend the Download method of OciDownloader and write corresponding test cases for it, so that this method can download OCI dependencies through digest.

The Download is here:

kpm/pkg/downloader/downloader.go

Line 379 in 8b50ab6

func (d *OciDownloader) Download(opts *DownloadOptions) error {

2. Extend the Visit method to RemoteVisitor so that this method can visit the corresponding KCL dependency through OCI regsitry's digest.

The Visit method is here:

kpm/pkg/visitor/visitor.go

Line 119 in 8b50ab6

func (rv *RemoteVisitor) Visit(s *downloader.Source, v visitFunc) error {

3. Adjust the methods provided by the package client so that all packages that can interact with OCI reigstry can support digest.

add - https://github.com/kcl-lang/kpm/blob/main/pkg/client/add.go
pull - https://github.com/kcl-lang/kpm/blob/main/pkg/client/pull.go
run - https://github.com/kcl-lang/kpm/blob/main/pkg/client/run.go

[7h3-3mp7y-m4n]

Thank you so much for your explanation. I'll definitely look at it and share my progress with you ASAP!
Thanks @zong-zhe !