Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Switch 'sigstore-probe' to copy the prober from the image rather than rebuilding every execution #130

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

evankanderson
Copy link
Member

Summary

Start work on #94. We currently see a fair amount of build flakiness (failed to fetch go library X) in the GitHub sigstore probes. By reducing this to two fetches (crane and the OCI image), we should hopefully see less flakiness.

Or I screwed everything up, and one probe will alert and we'll roll this back before trying again. (I'll try to get this running in my fork as well, but I wanted to offer this for review since I'd been sitting on it half-done for a while.)

Release Note

  • Reduce external dependencies and work needed for sigstore-probe probes in staging and production.

Documentation

No documentation needed.

@evankanderson
Copy link
Member Author

… rebuilding every execution

Signed-off-by: Evan Anderson <[email protected]>
@evankanderson
Copy link
Member Author

@bobcallaway should approve / merge this if he wants it this week.

@bobcallaway
Copy link
Member

why not just bake crane into the image?

@evankanderson
Copy link
Member Author

We're currently building the prober image with ko, which produces a single-binary image. (It doesn't even have cp to copy the file out of the image, or any other binaries besides the prober itself.)

I was trying to avoid adding a lot of new machinery (build new image with go / make / etc) in order to replace the existing images which we already have built and released.

I can look at building an image for these, but the retry action used later on means that we'll need to copy the binaries out of the image into some other location.

@bobcallaway
Copy link
Member

gcr.io/go-containerregistry/crane is regularly published

crane export $PROBE_IMAGE - | tar -xf - -C /tmp /ko-app/prober
cp /tmp/ko-app/prober /usr/local/bin
env:
PROBE_IMAGE: ghcr.io/sigstore/scaffolding/prober:v0.6.9@sha256:1b745626f5603698442ed55f4bdeb1a86f2192b603ccc3343750a3b70304ff94
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should this also be listed in a fake Dockerfile (and extracted here) so that Dependabot will see it and flag updates for it?

@cpanato
Copy link
Member

cpanato commented Jul 9, 2024

Is this still relevant?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants