Merge branch 'security-review' into fix/warn-container-daemon

Signed-off-by: Natalie Arellano <[email protected]>
buildpacks · Jul 10, 2024 · 456342b · 456342b
2 parents 0d0a495 + cbc880a
commit 456342b
Show file tree

Hide file tree

Showing 155 changed files with 7,127 additions and 776 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -23,7 +23,8 @@ jobs:
         config: [macos, linux, windows-lcow, windows-wcow]
         include:
           - config: macos
-            os: macos
+            # since macos-14 the latest runner is arm64
+            os: macos-arm64
             runner: macos-latest
             no_docker: "true"
             pack_bin: pack
@@ -170,8 +171,9 @@ jobs:
           - name: linux-arm64
             goarch: arm64
             goos: linux
-          - name: macos-arm64
-            goarch: arm64
+          - name: macos
+            # since macos-14 default runner is arm, we need to build for intel architecture later
+            goarch: amd64
             goos: darwin
           - name: linux-s390x
             goarch: s390x

diff --git a/.github/workflows/delivery-archlinux.yml b/.github/workflows/delivery-archlinux.yml
@@ -11,64 +11,6 @@ on:
         required: true
 
 jobs:
-  pack-cli:
-    runs-on: ubuntu-latest
-    env:
-      PACKAGE_NAME: pack-cli
-    steps:
-      - uses: actions/checkout@v4
-      - name: Determine version
-        uses: actions/github-script@v7
-        id: version
-        with:
-          result-encoding: string
-          script: |
-            let payload = context.payload;
-            let tag = (payload.release && payload.release.tag_name) || (payload.inputs && payload.inputs.tag_name);
-            if (!tag) {
-              throw "ERROR: unable to determine tag"
-            }
-            return tag.replace(/^v/, '');
-      - name: Set PACK_VERSION
-        run: echo "PACK_VERSION=${{ steps.version.outputs.result }}" >> $GITHUB_ENV
-        shell: bash
-      - name: Setup working dir
-        run: |
-          mkdir -p ${{ env.PACKAGE_NAME }}
-          cp .github/workflows/delivery/archlinux/${{ env.PACKAGE_NAME }}/PKGBUILD ${{ env.PACKAGE_NAME }}/PKGBUILD
-      - name: Metadata
-        id: metadata
-        run: |
-          url=https://github.com/buildpacks/pack/archive/v${{ env.PACK_VERSION }}.tar.gz
-          filename=pack-${{ env.PACK_VERSION }}.tgz
-          fullpath=`pwd`/$filename
-
-          curl -sSL "$url" -o "$fullpath"
-          sha512=$(sha512sum "$fullpath" | awk '{ print $1 }')
-          echo "url=$url" >> $GITHUB_OUTPUT
-          echo "sha512=$sha512" >> $GITHUB_OUTPUT
-      - name: Fill PKGBUILD
-        uses: cschleiden/replace-tokens@v1
-        with:
-          files: ${{ env.PACKAGE_NAME }}/PKGBUILD
-          tokenPrefix: '{{'
-          tokenSuffix: '}}'
-        env:
-          PACK_VERSION: ${{ env.PACK_VERSION }}
-          SRC_TGZ_URL: ${{ steps.metadata.outputs.url }}
-          SRC_TGZ_SHA: ${{ steps.metadata.outputs.sha512 }}
-      - name: Print PKGBUILD
-        run: cat ${{ env.PACKAGE_NAME }}/PKGBUILD
-      - name: Test
-        uses: docker://archlinux:latest
-        with:
-          entrypoint: .github/workflows/delivery/archlinux/test-install-package.sh
-      - name: Publish
-        uses: docker://archlinux:latest
-        env:
-          AUR_KEY: ${{ secrets.AUR_KEY }}
-        with:
-          entrypoint: .github/workflows/delivery/archlinux/publish-package.sh
   pack-cli-bin:
     runs-on: ubuntu-latest
     env:

diff --git a/.github/workflows/delivery-ubuntu.yml b/.github/workflows/delivery-ubuntu.yml
@@ -20,7 +20,7 @@ jobs:
       strategy:
         fail-fast: false
         matrix:
-          target: [bionic, focal, jammy, lunar, noble]
+          target: [bionic, focal, jammy, noble]
       runs-on: ubuntu-20.04
       steps:
           - name: Checkout code
@@ -103,18 +103,6 @@ jobs:
               GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
               PACKAGE_VERSION: ${{ steps.version.outputs.result }}
 
-          - name: Deliver lunar
-            if: matrix.target == 'lunar'
-            uses: docker://ubuntu:lunar
-            with:
-              entrypoint: .github/workflows/delivery/ubuntu/deliver.sh
-            env:
-              DEBIAN_FRONTEND: "noninteractive"
-              GO_DEP_PACKAGE_NAME: golang
-              GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-              GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
-              PACKAGE_VERSION: ${{ steps.version.outputs.result }}
-
           - name: Deliver noble
             if: matrix.target == 'noble'
             uses: docker://ubuntu:noble

diff --git a/.github/workflows/delivery/archlinux/README.md b/.github/workflows/delivery/archlinux/README.md
@@ -1,8 +1,8 @@
 # Arch Linux
 
-There are 3 maintained packages:
+There are two maintained packages by us and one official archlinux package:
 
-- [pack-cli](https://aur.archlinux.org/packages/pack-cli/): The latest release of `pack`, compiled from source.
+- [pack-cli](https://archlinux.org/packages/extra/x86_64/pack-cli/): Official Archlinux package in the 'Extra' repo.
 - [pack-cli-bin](https://aur.archlinux.org/packages/pack-cli-bin/): The latest release of `pack`, precompiled.
 - [pack-cli-git](https://aur.archlinux.org/packages/pack-cli-git/): An unreleased version of `pack`, compiled from source of the `main` branch.
 

diff --git a/.github/workflows/delivery/archlinux/pack-cli/PKGBUILD b/.github/workflows/delivery/archlinux/pack-cli/PKGBUILD
diff --git a/Dockerfile b/Dockerfile
@@ -1,6 +1,6 @@
 ARG base_image=gcr.io/distroless/static
 
-FROM golang:1.20 as builder
+FROM golang:1.22 as builder
 ARG pack_version
 ENV PACK_VERSION=$pack_version
 WORKDIR /app