Skip to content

cmd-build-with-buildah: update meta.json with pkg/advisory diffs #4327

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Sep 29, 2025
Merged

cmd-build-with-buildah: update meta.json with pkg/advisory diffs #4327

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
996f849
Revert "cmd-diff: default --from to N-1 build"
dustymabe Sep 28, 2025
aafbc3c
cmd-build-with-buildah: remove semicolon
dustymabe Sep 18, 2025
6cba969
cmd-build-with-buildah: update meta.json with pkg/advisory diffs
dustymabe Sep 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions src/cmd-build-with-buildah
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,8 @@ Usage: coreos-assembler build-with-buildah
non-strict build.
--skip-prune Skip pruning previous builds.
--strict Only allow installing locked packages when using lockfiles.
--parent-build=VERSION This option does nothing and is provided for backwards compatibility.
--parent-build=VERSION The version that represents the parent to this build. Used for RPM diffs
that get added to the meta.json
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cool, and with this, we now no longer have any "no-op compat" switches!

--force Import a new build even if inputhash has not changed.
EOF
}
Expand Down Expand Up @@ -58,7 +59,7 @@ while true; do
DIRECT=1
;;
--autolock)
shift;
shift
AUTOLOCK_VERSION=$1
;;
--skip-prune)
Expand All @@ -69,6 +70,7 @@ while true; do
;;
--parent-build)
shift
PARENT_BUILD=$1
;;
--force)
FORCE=1
Expand Down Expand Up @@ -232,6 +234,19 @@ build_with_buildah() {
/usr/lib/coreos-assembler/cmd-import "${final_ref}" ${SKIP_PRUNE:+--skip-prune}
fi

# For the logs, print the RPM diff
/usr/lib/coreos-assembler/cmd-diff \
--rpms ${PARENT_BUILD:+--from=$PARENT_BUILD}

# For meta.json let's record the RPM diff and advisory diff information
/usr/lib/coreos-assembler/cmd-diff \
--rpms-json ${PARENT_BUILD:+--from=$PARENT_BUILD} |
jq '{"pkgdiff": .pkgdiff, "advisories-diff": .advisories}' > "${tempdir}/diff.json"
/usr/lib/coreos-assembler/cmd-meta --build="${VERSION}" \
--skip-validation --artifact-json "${tempdir}/diff.json"
# Run a 'dump' now to perform schema validation since we skipped it above.
/usr/lib/coreos-assembler/cmd-meta --dump --build="${VERSION}" > /dev/null

Comment on lines +237 to +249
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, I think this probably should instead live in cosa import. That's the command that actually adds a new build. Then cosa build-with-buildah would just proxy the --parent-build switch like it does today for --skip-prune.

And also that way, we can populate meta.json with that info from the very start instead of as a post operation.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I initially had started working to do just what you propose and I still wish I had a local stash, but I don't see it.

Let me explain why I backed off of that approach.

  1. I have an effort that will persist container-storage of the supermin VM across runs
  2. At one point I was going to have cosa import run inside the supermin VM too
  3. Prior to 77dbc4e cosa diff was going to be heavyweight (i.e. have to import the ociarchive of the parent in order to generate the diff)
  4. I didn't want to do the heavyweight ociarchive import inside the supermin VM
  5. The only way to have the ociarchive import happen outside the supermin VM (if cosa import was going to happen inside the supermin VM, was to run it in build-with-buildah.

Fast forwarding to today. The diff should be lightweight regardless of where it is run so we should be able to do it in cosa import no problem.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Opened #4336

rm -rf "${tempdir}"
}

Expand Down
2 changes: 1 addition & 1 deletion src/cmd-diff
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ def main():
args.diff_from = builds.get_previous()
args.diff_to = latest_build
elif args.diff_from is None:
args.diff_from = builds.get_previous()
args.diff_from = latest_build
elif args.diff_to is None:
args.diff_to = latest_build

Expand Down
Loading