Since the command `ostree container commit` checks for the presence of
mounted directories, we will be running it at the end of each module
run. We have also updated the final commit to remove from /tmp/ and
/var/ again in case a user creates extra files through custom
instructions.
Closes#101#95
This separates out the module template logic so that it is easier to
undertstand what each section does. This will also allow creating in
repo documentation for any special modules that don't use a bash base.
An issue was filed for adding retry logic to our push_image command in
the CLI. https://github.com/blue-build/cli/issues/79.
This PR adds:
- **retry flag**
- `-r`
- defaults to true
- **retry_count flag**
- `--retry_count`
- defaults to 1
This functionality will be extended to our other services in build
(podman api as well once that is hooked up), but this is the initial
ground work
---------
Co-authored-by: Gerald Pinder <gmpinder@gmail.com>
The akmods module require having the /rpms directory put into /tmp/rpms.
By default we will mount the akmods image with the `main-{{ os_version
}}` tag.
If a user supplies `base` for the akmods module in their recipe, it will
pull that image tag instead and mount the resulting /rpms.
```yaml
modules:
- type: akmods
base: surface
install:
- openrazer
```
This would pull the image `ghcr.io/ublue-os/akmods:surface-39`.
A user can also supply `nvidia-version` with the numerical version of
the driver you would like to use. Doing so will mount the appropriate
`akmods-nvidia` image with the version of the driver you want in the
tag.
```yaml
modules:
- type: akmods
nvidia-version: 545
install:
- nvidia
```
This would pull the image `ghcr.io/ublue-os/akmods-nvidia:main-39-545`
and `ghcr.io/ublue-os/akmods:main-39`.
This uses bind mount like all the other modules so these files will not
persist into the final image.
To keep things as consistent as possible, we're switching to using the
GITHUB_TOKEN env var for login instead. Env vars were also all pulled
out into their own constants to make things more consistent.
This change also includes prioritizing public/private key signing over
OIDC keyless for GitHub for an easier transition. It would require the
user to delete their `cosign.pub` file from their repo in order to start
using the keyless method.
Trailing newlines is something that we will never need as an
information, so it can only cause issues with parsing yaml values.
I scratched my head for 10 minutes on why my variable has a trailing
newline when I use `readarray -t` everywhere. Then I remembered
get_yaml_array function.
This should not affect current working modules at all, but it would be
good to test before landing.
Co-authored-by: Gerald Pinder <gmpinder@gmail.com>
After setting up the tmpfs mount for /var, rpm-ostree started to not
have cache throughout the single build. This creates a cache for
rpm-ostree that is tied to the specific recipe being built. This will
allow subsequent builds of a recipe to be faster and not interfere with
the cache of another recipe, especially if they are on different OS
versions
the `SIGSTORE_ID_TOKEN` env var is not declared inside of github
actions, however the block that does OIDC signing requires it, this
changes it so that it matches for `GITHUB_TOKEN` in the second block
instead of `SIGSTORE_ID_TOKEN`, (hopefully) using OIDC instead of pubkey
auth
This allows scripts to create as many files as they need in /tmp and
/var without having to worry about them being included in the final
image. Now the last instruction will only be the ostree container commit
required for running the bluebuild CLI directly from podman (needed for
latest version of bluebuild for github action)
---------
Co-authored-by: Gerald Pinder <gmpinder@gmail.com>
This change will follow the patter that was established with the GitLab
pipeline. Users will be able to have their images signed by GitHub's
OIDC. This will allow users to rebase directly onto a signed image and
forego using the siging module.
This allows us to prevent creating extra layers just to run the modules.
Using the bind mount, we are able to connect to a working container that
holds the files needed for building.
