From ed499fd2d0e23529bb3213cfe883be8068342ce4 Mon Sep 17 00:00:00 2001 From: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Date: Wed, 15 Jul 2026 16:52:46 -0400 Subject: [PATCH] chore: migrate `.goreleaser` config to use docker_v2 (#4608) --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> --- .github/workflows/release.yaml | 9 +- .github/workflows/validations.yaml | 10 +- .goreleaser.yaml | 370 ++++++----------------------- Dockerfile | 22 +- Dockerfile.debug | 26 +- Dockerfile.debug-nonroot | 12 + Dockerfile.nonroot | 22 +- Taskfile.yaml | 10 +- 8 files changed, 121 insertions(+), 360 deletions(-) create mode 100644 Dockerfile.debug-nonroot diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 9d3981475..39e4fe7da 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -63,8 +63,13 @@ jobs: # spot disabled: reliability for build workflows (used for releases too) # goreleaser uses parallelism of 12, so we need more CPUs # s3-cache: faster actions cache - # tmpfs: faster io-intensive workflows - runs-on: runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/extras=s3-cache+tmpfs + # volume: enlarge dist/ disk -- the default 40GB EBS root fills up during the multi-arch + # image + binary build and OOMs (runs out of disk); size it well above peak usage. + # provisioned throughput/iops above the gp3 free baseline (125mbs/3000iops) approximate + # the tmpfs IO speed on disk, for ~1c/run. + # note: tmpfs intentionally omitted -- a RAM-backed dist/ never touches the enlarged + # volume and competes with the build's memory peak, so keep dist/ on disk. + runs-on: runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/extras=s3-cache/volume=120gb:gp3:500mbs:4000iops permissions: contents: write # required for creating the GitHub release and pushing the version tag packages: write # required for publishing release artifacts to GitHub packages diff --git a/.github/workflows/validations.yaml b/.github/workflows/validations.yaml index c520a05b7..746319f30 100644 --- a/.github/workflows/validations.yaml +++ b/.github/workflows/validations.yaml @@ -92,10 +92,16 @@ jobs: # runs-on.com: compute instances for parallel builds # spot disabled: reliability for build workflows (used for releases too) # goreleaser uses parallelism of 12, so we need more CPUs - # tmpfs: faster io-intensive workflows + # tmpfs intentionally omitted -- a RAM-backed dist/ competes with the goreleaser + # build's memory peak (parallel binaries + multi-arch image assembly) and OOMs the + # instance; keep dist/ on disk. # note: s3-cache intentionally omitted -- PR runs are untrusted and must not write to the # shared cache backend that the trusted release workflow reads from (cache poisoning). - runs-on: "runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/extras=tmpfs" + # volume: enlarge dist/ disk -- the default 40GB EBS root fills up during the multi-arch + # image + binary build and OOMs (runs out of disk); size it well above peak usage. + # provisioned throughput/iops above the gp3 free baseline (125mbs/3000iops) approximate + # the tmpfs IO speed on disk, for ~1c/run. + runs-on: "runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/volume=120gb:gp3:500mbs:4000iops" permissions: contents: read steps: diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 3edce4f6d..d5bb7de18 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -73,306 +73,88 @@ brews: description: *description license: "Apache License 2.0" -dockers: - # production images... - - image_templates: - - anchore/syft:{{.Tag}}-amd64 - - ghcr.io/anchore/syft:{{.Tag}}-amd64 - goarch: amd64 +dockers_v2: + # production images (scratch base, root) + - id: production dockerfile: Dockerfile - use: buildx - build_flag_templates: - - "--platform=linux/amd64" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" + ids: &docker-ids + - linux-build + images: &docker-images + - anchore/syft + - ghcr.io/anchore/syft + platforms: &docker-platforms + - linux/amd64 + - linux/arm64 + - linux/ppc64le + - linux/riscv64 + - linux/s390x + labels: &docker-labels + "org.opencontainers.image.created": "{{.Date}}" + "org.opencontainers.image.title": "syft" + "org.opencontainers.image.description": "CLI tool and library for generating a Software Bill of Materials from container images and filesystems" + "org.opencontainers.image.source": "{{.GitURL}}" + "org.opencontainers.image.revision": "{{.FullCommit}}" + "org.opencontainers.image.vendor": "Anchore, Inc." + "org.opencontainers.image.version": "{{.Version}}" + "org.opencontainers.image.licenses": "Apache-2.0" + "io.artifacthub.package.readme-url": "https://raw.githubusercontent.com/anchore/syft/main/README.md" + "io.artifacthub.package.logo-url": "https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png" + "io.artifacthub.package.license": "Apache-2.0" + tags: + - latest + - "{{.Tag}}" + # DEBIAN_VERSION 13 (trixie) is the first distroless release with a riscv64 base image + # and is a superset of debian 12 for the other targeted arches; docker_v2 builds all + # platforms in a single buildx invocation, so build_args cannot vary per platform. + build_args: &docker-build-args + DEBIAN_VERSION: "13" + # disable provenance attestations to keep the manifest free of unknown/unknown entries + flags: &docker-flags + - "--provenance=false" + # SBOMs are produced separately for the archives (see the sboms section) + sbom: &docker-sbom "false" - - image_templates: - - anchore/syft:{{.Tag}}-arm64v8 - - ghcr.io/anchore/syft:{{.Tag}}-arm64v8 - goarch: arm64 - dockerfile: Dockerfile - use: buildx - build_flag_templates: - - "--platform=linux/arm64/v8" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" - - - image_templates: - - anchore/syft:{{.Tag}}-ppc64le - - ghcr.io/anchore/syft:{{.Tag}}-ppc64le - goarch: ppc64le - dockerfile: Dockerfile - use: buildx - build_flag_templates: - - "--platform=linux/ppc64le" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" - - - image_templates: - - anchore/syft:{{.Tag}}-riscv64 - - ghcr.io/anchore/syft:{{.Tag}}-riscv64 - goarch: riscv64 - dockerfile: Dockerfile - use: buildx - build_flag_templates: - - "--platform=linux/riscv64" - - "--build-arg=DEBIAN_VERSION=13" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" - - - image_templates: - - anchore/syft:{{.Tag}}-s390x - - ghcr.io/anchore/syft:{{.Tag}}-s390x - goarch: s390x - dockerfile: Dockerfile - use: buildx - build_flag_templates: - - "--platform=linux/s390x" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" - - # nonroot images... - - image_templates: - - anchore/syft:{{.Tag}}-nonroot-amd64 - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64 - goarch: amd64 + # nonroot images + - id: nonroot dockerfile: Dockerfile.nonroot - use: buildx - build_flag_templates: - - "--platform=linux/amd64" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" + ids: *docker-ids + images: *docker-images + platforms: *docker-platforms + labels: *docker-labels + tags: + - nonroot + - "{{.Tag}}-nonroot" + build_args: *docker-build-args + flags: *docker-flags + sbom: *docker-sbom - - image_templates: - - anchore/syft:{{.Tag}}-nonroot-arm64v8 - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8 - goarch: arm64 - dockerfile: Dockerfile.nonroot - use: buildx - build_flag_templates: - - "--platform=linux/arm64/v8" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" - - - image_templates: - - anchore/syft:{{.Tag}}-nonroot-ppc64le - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le - goarch: ppc64le - dockerfile: Dockerfile.nonroot - use: buildx - build_flag_templates: - - "--platform=linux/ppc64le" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" - - - image_templates: - - anchore/syft:{{.Tag}}-nonroot-riscv64 - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-riscv64 - goarch: riscv64 - dockerfile: Dockerfile.nonroot - use: buildx - build_flag_templates: - - "--platform=linux/riscv64" - - "--build-arg=DEBIAN_VERSION=13" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" - - - image_templates: - - anchore/syft:{{.Tag}}-nonroot-s390x - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x - goarch: s390x - dockerfile: Dockerfile.nonroot - use: buildx - build_flag_templates: - - "--platform=linux/s390x" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" - - # debug images... - - image_templates: - - anchore/syft:{{.Tag}}-debug-amd64 - - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64 - goarch: amd64 + # debug images (root) + - id: debug dockerfile: Dockerfile.debug - use: buildx - build_flag_templates: - - "--platform=linux/amd64" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" + ids: *docker-ids + images: *docker-images + platforms: *docker-platforms + labels: *docker-labels + tags: + - debug + - "{{.Tag}}-debug" + build_args: *docker-build-args + flags: *docker-flags + sbom: *docker-sbom - - image_templates: - - anchore/syft:{{.Tag}}-debug-arm64v8 - - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8 - goarch: arm64 - dockerfile: Dockerfile.debug - use: buildx - build_flag_templates: - - "--platform=linux/arm64/v8" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" - - - image_templates: - - anchore/syft:{{.Tag}}-debug-ppc64le - - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le - goarch: ppc64le - dockerfile: Dockerfile.debug - use: buildx - build_flag_templates: - - "--platform=linux/ppc64le" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" - - - image_templates: - - anchore/syft:{{.Tag}}-debug-riscv64 - - ghcr.io/anchore/syft:{{.Tag}}-debug-riscv64 - goarch: riscv64 - dockerfile: Dockerfile.debug - use: buildx - build_flag_templates: - - "--platform=linux/riscv64" - - "--build-arg=DEBIAN_VERSION=13" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" - - - image_templates: - - anchore/syft:{{.Tag}}-debug-s390x - - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x - goarch: s390x - dockerfile: Dockerfile.debug - use: buildx - build_flag_templates: - - "--platform=linux/s390x" - - "--build-arg=BUILD_DATE={{.Date}}" - - "--build-arg=BUILD_VERSION={{.Version}}" - - "--build-arg=VCS_REF={{.FullCommit}}" - - "--build-arg=VCS_URL={{.GitURL}}" - -docker_manifests: - - name_template: anchore/syft:latest - image_templates: - - anchore/syft:{{.Tag}}-amd64 - - anchore/syft:{{.Tag}}-arm64v8 - - anchore/syft:{{.Tag}}-ppc64le - - anchore/syft:{{.Tag}}-riscv64 - - anchore/syft:{{.Tag}}-s390x - - - name_template: ghcr.io/anchore/syft:latest - image_templates: - - ghcr.io/anchore/syft:{{.Tag}}-amd64 - - ghcr.io/anchore/syft:{{.Tag}}-arm64v8 - - ghcr.io/anchore/syft:{{.Tag}}-ppc64le - - ghcr.io/anchore/syft:{{.Tag}}-riscv64 - - ghcr.io/anchore/syft:{{.Tag}}-s390x - - - name_template: anchore/syft:{{.Tag}} - image_templates: - - anchore/syft:{{.Tag}}-amd64 - - anchore/syft:{{.Tag}}-arm64v8 - - anchore/syft:{{.Tag}}-ppc64le - - anchore/syft:{{.Tag}}-riscv64 - - anchore/syft:{{.Tag}}-s390x - - - name_template: ghcr.io/anchore/syft:{{.Tag}} - image_templates: - - ghcr.io/anchore/syft:{{.Tag}}-amd64 - - ghcr.io/anchore/syft:{{.Tag}}-arm64v8 - - ghcr.io/anchore/syft:{{.Tag}}-ppc64le - - ghcr.io/anchore/syft:{{.Tag}}-riscv64 - - ghcr.io/anchore/syft:{{.Tag}}-s390x - - # nonroot images... - - name_template: anchore/syft:nonroot - image_templates: - - anchore/syft:{{.Tag}}-nonroot-amd64 - - anchore/syft:{{.Tag}}-nonroot-arm64v8 - - anchore/syft:{{.Tag}}-nonroot-ppc64le - - anchore/syft:{{.Tag}}-nonroot-riscv64 - - anchore/syft:{{.Tag}}-nonroot-s390x - - - name_template: ghcr.io/anchore/syft:nonroot - image_templates: - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64 - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8 - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-riscv64 - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x - - - name_template: anchore/syft:{{.Tag}}-nonroot - image_templates: - - anchore/syft:{{.Tag}}-nonroot-amd64 - - anchore/syft:{{.Tag}}-nonroot-arm64v8 - - anchore/syft:{{.Tag}}-nonroot-ppc64le - - anchore/syft:{{.Tag}}-nonroot-riscv64 - - anchore/syft:{{.Tag}}-nonroot-s390x - - - name_template: ghcr.io/anchore/syft:{{.Tag}}-nonroot - image_templates: - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-amd64 - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-arm64v8 - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-ppc64le - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-riscv64 - - ghcr.io/anchore/syft:{{.Tag}}-nonroot-s390x - - # debug images... - - name_template: anchore/syft:debug - image_templates: - - anchore/syft:{{.Tag}}-debug-amd64 - - anchore/syft:{{.Tag}}-debug-arm64v8 - - anchore/syft:{{.Tag}}-debug-ppc64le - - anchore/syft:{{.Tag}}-debug-riscv64 - - anchore/syft:{{.Tag}}-debug-s390x - - - name_template: ghcr.io/anchore/syft:debug - image_templates: - - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64 - - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8 - - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le - - ghcr.io/anchore/syft:{{.Tag}}-debug-riscv64 - - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x - - - name_template: anchore/syft:{{.Tag}}-debug - image_templates: - - anchore/syft:{{.Tag}}-debug-amd64 - - anchore/syft:{{.Tag}}-debug-arm64v8 - - anchore/syft:{{.Tag}}-debug-ppc64le - - anchore/syft:{{.Tag}}-debug-riscv64 - - anchore/syft:{{.Tag}}-debug-s390x - - - name_template: ghcr.io/anchore/syft:{{.Tag}}-debug - image_templates: - - ghcr.io/anchore/syft:{{.Tag}}-debug-amd64 - - ghcr.io/anchore/syft:{{.Tag}}-debug-arm64v8 - - ghcr.io/anchore/syft:{{.Tag}}-debug-ppc64le - - ghcr.io/anchore/syft:{{.Tag}}-debug-riscv64 - - ghcr.io/anchore/syft:{{.Tag}}-debug-s390x + # debug-nonroot images + - id: debug-nonroot + dockerfile: Dockerfile.debug-nonroot + ids: *docker-ids + images: *docker-images + platforms: *docker-platforms + labels: *docker-labels + tags: + - debug-nonroot + - "{{.Tag}}-debug-nonroot" + build_args: *docker-build-args + flags: *docker-flags + sbom: *docker-sbom sboms: - artifacts: archive diff --git a/Dockerfile b/Dockerfile index 86ff23db2..4dc169ab5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -ARG DEBIAN_VERSION=12 +ARG DEBIAN_VERSION=13 FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:latest AS build FROM scratch @@ -8,23 +8,7 @@ COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certifica # create the /tmp dir, which is needed for image content cache WORKDIR /tmp -COPY syft / - -ARG BUILD_DATE -ARG BUILD_VERSION -ARG VCS_REF -ARG VCS_URL - -LABEL org.opencontainers.image.created=$BUILD_DATE -LABEL org.opencontainers.image.title="syft" -LABEL org.opencontainers.image.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems" -LABEL org.opencontainers.image.source=$VCS_URL -LABEL org.opencontainers.image.revision=$VCS_REF -LABEL org.opencontainers.image.vendor="Anchore, Inc." -LABEL org.opencontainers.image.version=$BUILD_VERSION -LABEL org.opencontainers.image.licenses="Apache-2.0" -LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/anchore/syft/main/README.md" -LABEL io.artifacthub.package.logo-url="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png" -LABEL io.artifacthub.package.license="Apache-2.0" +ARG TARGETPLATFORM +COPY ${TARGETPLATFORM}/syft / ENTRYPOINT ["/syft"] diff --git a/Dockerfile.debug b/Dockerfile.debug index 936b5ffc1..697527b10 100644 --- a/Dockerfile.debug +++ b/Dockerfile.debug @@ -1,28 +1,10 @@ -ARG DEBIAN_VERSION=12 -FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:debug-nonroot +ARG DEBIAN_VERSION=13 +FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:debug # create the /tmp dir, which is needed for image content cache WORKDIR /tmp -COPY syft / - -USER nonroot - -ARG BUILD_DATE -ARG BUILD_VERSION -ARG VCS_REF -ARG VCS_URL - -LABEL org.opencontainers.image.created=$BUILD_DATE -LABEL org.opencontainers.image.title="syft" -LABEL org.opencontainers.image.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems" -LABEL org.opencontainers.image.source=$VCS_URL -LABEL org.opencontainers.image.revision=$VCS_REF -LABEL org.opencontainers.image.vendor="Anchore, Inc." -LABEL org.opencontainers.image.version=$BUILD_VERSION -LABEL org.opencontainers.image.licenses="Apache-2.0" -LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/anchore/syft/main/README.md" -LABEL io.artifacthub.package.logo-url="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png" -LABEL io.artifacthub.package.license="Apache-2.0" +ARG TARGETPLATFORM +COPY ${TARGETPLATFORM}/syft / ENTRYPOINT ["/syft"] diff --git a/Dockerfile.debug-nonroot b/Dockerfile.debug-nonroot new file mode 100644 index 000000000..0e152cc12 --- /dev/null +++ b/Dockerfile.debug-nonroot @@ -0,0 +1,12 @@ +ARG DEBIAN_VERSION=13 +FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:debug-nonroot + +# create the /tmp dir, which is needed for image content cache +WORKDIR /tmp + +ARG TARGETPLATFORM +COPY ${TARGETPLATFORM}/syft / + +USER nonroot + +ENTRYPOINT ["/syft"] diff --git a/Dockerfile.nonroot b/Dockerfile.nonroot index c6789d4c7..61c937c70 100644 --- a/Dockerfile.nonroot +++ b/Dockerfile.nonroot @@ -1,28 +1,12 @@ -ARG DEBIAN_VERSION=12 +ARG DEBIAN_VERSION=13 FROM gcr.io/distroless/static-debian${DEBIAN_VERSION}:nonroot # create the /tmp dir, which is needed for image content cache WORKDIR /tmp -COPY syft / +ARG TARGETPLATFORM +COPY ${TARGETPLATFORM}/syft / USER nonroot -ARG BUILD_DATE -ARG BUILD_VERSION -ARG VCS_REF -ARG VCS_URL - -LABEL org.opencontainers.image.created=$BUILD_DATE -LABEL org.opencontainers.image.title="syft" -LABEL org.opencontainers.image.description="CLI tool and library for generating a Software Bill of Materials from container images and filesystems" -LABEL org.opencontainers.image.source=$VCS_URL -LABEL org.opencontainers.image.revision=$VCS_REF -LABEL org.opencontainers.image.vendor="Anchore, Inc." -LABEL org.opencontainers.image.version=$BUILD_VERSION -LABEL org.opencontainers.image.licenses="Apache-2.0" -LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/anchore/syft/main/README.md" -LABEL io.artifacthub.package.logo-url="https://user-images.githubusercontent.com/5199289/136844524-1527b09f-c5cb-4aa9-be54-5aa92a6086c1.png" -LABEL io.artifacthub.package.license="Apache-2.0" - ENTRYPOINT ["/syft"] diff --git a/Taskfile.yaml b/Taskfile.yaml index d0ae4f20d..7e671c38e 100644 --- a/Taskfile.yaml +++ b/Taskfile.yaml @@ -39,6 +39,12 @@ vars: PROJECT_ROOT: sh: echo $PWD + # docker platform suffix goreleaser appends to snapshot image tags (e.g. latest-amd64). + # snapshot builds load per-arch images rather than a multi-arch manifest, so the smoke + # test must run the host-native tag to avoid emulation (and red-local/green-CI splits). + DOCKER_ARCH: + sh: go env GOARCH + # note: the snapshot dir must be a relative path starting with ./ # e.g. when installing snapshot debs from a local path, ./ forces the deb to be installed in the current working directory instead of referencing a package name SNAPSHOT_DIR: ./snapshot @@ -129,8 +135,8 @@ tasks: silent: true - "{{ .SNAPSHOT_BIN }} version" - "{{ .SNAPSHOT_BIN }} scan alpine:latest" - - docker run --rm anchore/syft:latest version - - docker run --rm anchore/syft:latest scan alpine:latest + - docker run --pull=never --rm anchore/syft:latest-{{ .DOCKER_ARCH }} version + - docker run --pull=never --rm anchore/syft:latest-{{ .DOCKER_ARCH }} scan alpine:latest ## Test-fixture-related targets ###########################################