Skip to content

Read release digest and scope helper-image reproducibility #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chen21019 merged 2 commits into from
Sep 9, 2026
Merged

Read release digest and scope helper-image reproducibility #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fed313b
Read release digest from registry manifest
chen21019 Sep 9, 2026
ad41d28
Scope reproducibility to release outputs
chen21019 Sep 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,8 +166,8 @@ jobs:
set -euo pipefail
printf '%s' "$GHCR_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
docker push "$RUNTIME_IMAGE"
reference="$(docker image inspect --format '{{index .RepoDigests 0}}' "$RUNTIME_IMAGE")"
digest="${reference#*@}"
digest="$("$LOCKED_BUILDX" imagetools inspect "$RUNTIME_IMAGE" \
--format '{{.Manifest.Digest}}')"
[[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
printf 'digest=%s\n' "$digest" >> "$GITHUB_OUTPUT"
Expand Down
9 changes: 5 additions & 4 deletions .github/workflows/supply-chain.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -438,15 +438,16 @@ jobs:
diff -u \
evidence/ecr-credential-sync-first.sha256 \
evidence/ecr-credential-sync-second.sha256
# The Dapper image is a disposable build environment. Ubuntu package
# maintainer scripts can emit different layer metadata even when the
# pinned packages, toolchain binaries, source inputs, and shipped
# runtime image are identical. Compare those outcome-bearing artifacts
# instead of blocking a release on the helper image's OCI identity.
for artifact in \
image-id.txt \
daemon-id-mode.txt \
buildkit-image.txt \
buildkit-version.txt \
manifest-digest.txt \
config-digest.txt \
created.txt \
rootfs-diffids.json \
binary-build-info.txt \
ubuntu-apt.lock \
dapper-ubuntu-packages.tsv \
Expand Down
2 changes: 1 addition & 1 deletion scripts/check-source-gates
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1055,5 +1055,5 @@ if [ "$failure_count" -ne 0 ]; then
exit 1
fi

printf 'ECR_SYNC_SOURCE_GATES_OK go=1.27.0 go_telemetry=off-source-date-epoch-utc go_telemetry_readbacks=5 go_telemetry_cleanup_cwd=two-callers-explicit-root-before-delete docker=29.7.2 docker_cli_source_built=go1.27.0 buildx=0.36.1 dapper_buildx_executable_version=v0.36.1 buildx_go_archive=v0.3.0 buildx_x_mod=v0.40.0 buildx_grpc=v1.83.2 buildx_cves_fixed=5 buildx_patch=sha256:a29fdda204d592d0d46ed32b5fdc4336a7b3a7276301836d0a75b9386ca780f7 jq=1.8.1 jq_package=1.8.1-4ubuntu2 host_buildx=0.36.1 host_buildx_binary=sha256:05d6007425f3ec0c9bcf10aad49034e4342c34bd63ecd1cb0ac89ddfdf934c79 host_buildx_builds=2-offline-reproducible host_buildkit=0.32.2 buildkit_version_readback=exact-single-record dapper_identity=buildx-iid+metadata-config+daemon-config-or-manifest ubuntu_builder=26.04 snapshot=20260909T000000Z runtime_base=scratch non_root=1 legal_files=%s endpoint_override=bounded brand_gate=tracked_source_only buildx_legacy_module_removed=1 embedded_patch_whitespace_scope=exact-path-with-inner-validation runtime_mtime_normalization=all_local_copy_inputs dapper_reproducibility=buildkit-rewrite-timestamp runtime_export=docker-archive-explicit-load runtime_builder=exact-run-owned-pinned sbom_trivy_gate=1\n' \
printf 'ECR_SYNC_SOURCE_GATES_OK go=1.27.0 go_telemetry=off-source-date-epoch-utc go_telemetry_readbacks=5 go_telemetry_cleanup_cwd=two-callers-explicit-root-before-delete docker=29.7.2 docker_cli_source_built=go1.27.0 buildx=0.36.1 dapper_buildx_executable_version=v0.36.1 buildx_go_archive=v0.3.0 buildx_x_mod=v0.40.0 buildx_grpc=v1.83.2 buildx_cves_fixed=5 buildx_patch=sha256:a29fdda204d592d0d46ed32b5fdc4336a7b3a7276301836d0a75b9386ca780f7 jq=1.8.1 jq_package=1.8.1-4ubuntu2 host_buildx=0.36.1 host_buildx_binary=sha256:05d6007425f3ec0c9bcf10aad49034e4342c34bd63ecd1cb0ac89ddfdf934c79 host_buildx_builds=2-offline-reproducible host_buildkit=0.32.2 buildkit_version_readback=exact-single-record dapper_identity=buildx-iid+metadata-config+daemon-config-or-manifest ubuntu_builder=26.04 snapshot=20260909T000000Z runtime_base=scratch non_root=1 legal_files=%s endpoint_override=bounded brand_gate=tracked_source_only buildx_legacy_module_removed=1 embedded_patch_whitespace_scope=exact-path-with-inner-validation runtime_mtime_normalization=all_local_copy_inputs dapper_reproducibility=semantic-toolchain-and-runtime-outputs runtime_export=docker-archive-explicit-load runtime_builder=exact-run-owned-pinned sbom_trivy_gate=1\n' \
"$legal_count"