bldr
bldr copied to clipboard
siderolabs
This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/siderolabs/bldr). ## Open The following updates have all...
![renovate[bot] avatar](https://avatars.githubusercontent.com/in/2740?v=4 "renovate[bot] avatar"){kind=avatar}
Update Request | Renovate Bot This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | alpine | | minor | `3.19` -> `3.20`...
Update Request | Renovate Bot This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [github.com/containerd/containerd](https://togithub.com/containerd/containerd) | `v1.7.17` ->...
It should be possible to refer to images (and variants) by their SHA256 digest using the standard syntax `NAME[:TAG][@DIGEST]`. The correct digest, if present, should be enforced. It also should...
Take a look at the `Makefile` in that PR: https://github.com/talos-systems/toolchain/pull/24/files It builds a target twice and compares results, pruning the whole cache between builds. I think it has two problems...
Be "smart" here, potentially handling different layouts of download locations (e.g. http file server, GitHub releases, etc.) Run something like `bldr check-versions` and receive output similar to: ``` NAME VERSION...
In addition to checking checksums, it might be a good idea to check PGP signatures for packages that have them. For example, https://github.com/opencontainers/runc/releases/tag/v1.0.0
```diff - sources: - - url: https://ftp.gnu.org/gnu/make/make-4.3.tar.gz + - url: https://ftp.gnu.org/gnu/make/make-4.4.tar.gz destination: make.tar.gz sha256: e05fdde47c5f7ca45cb697e973894ff4f5d79e13b750ed57d7b66d8defc78e19 sha512: 9a1185cc468368f4ec06478b1cfa343bf90b5cd7c92c0536567db0315b0ee909af53ecce3d44cfd93dd137dbca1ed13af5713e8663590c4fdd21ea635d78496b ``` If make-4.3.tar.gz was previously downloaded, that patch does not trigger a rebuild.
Custom SHA512 checksum check should be glued into LLB graph so that failures terminates the build Today we copy empty directory to bind those steps, but this is not clean:...
Default variables contain `talos` many times. If `bldr` is generic, we should allow this to be overridable. One of the options is to use `Pkgfile` to provide `vendor` variable and...