backport: Add Containerfile.art for ART onboarding - #2503
Conversation
e437262 to
a61dd84
Compare
Use cachi2 artifact_lockfile to prefetch data files from public Red Hat URLs during the cachito phase. This enables hermetic builds by making files available in /cachi2/output/deps/generic/ before the build starts, avoiding network calls during container build. Signed-off-by: Shruti Anekar <sanekar@redhat.com>
a61dd84 to
75c5343
Compare
|
Clair 4.8 is no longer supported, so I don't think this should be merged. |
|
@hdonnay Quay still uses 4.8 for old versions AFAIK, we need to be able to build from this branch cc @Marcusk19 |
|
That's not the agreement we have with the Quay team. All Quay versions should be on the same (latest) Clair version. |
I imagine this agreement predates me as I haven't heard of it. Do we have this documented anywhere? There is clear risk for us to bump our EUS versions to latest Clair versions. Our full supported versions are all on latest Clair. 3.15 and older seem to not be |
I assumed this was in the Quay release documentation somewhere. |
Enable hermetic build support by pre-declaring data file artifacts for cachi2 prefetch. Files (repository-to-cpe.json and container-name-repos-map.json) will be downloaded during the prefetch phase and available at /cachi2/output/deps/generic/ for the build. Signed-off-by: Shruti Anekar <sanekar@redhat.com>
3 participants
Adds contrib/art/Containerfile.art for ART onboarding (ART-19361).
Include repository-to-cpe.json and container-name-repos-map.json data
files in contrib/art/ for use during container build.
ADD https:// fails in hermetic as well as open builds as quay-konflux-components is a private repository, hence using COPY with local files instead to enable both hermetic and open builds without external network calls.