chore(tekton): enable hermetic builds with dependency prefetching - #91
Draft
yalzhang wants to merge 2 commits into
Draft
chore(tekton): enable hermetic builds with dependency prefetching#91yalzhang wants to merge 2 commits into
yalzhang wants to merge 2 commits into
Conversation
yalzhang
force-pushed
the
update_pipefile
branch
from
February 15, 2026 01:41
2b3e926 to
5ee352e
Compare
Contributor
Author
|
/rerun |
Contributor
Author
|
/retest |
Contributor
Author
|
The pipeline run fail because of a version mismatch:
|
Contributor
Author
|
/retest |
yalzhang
force-pushed
the
update_pipefile
branch
3 times, most recently
from
February 25, 2026 13:24
be088db to
94e1342
Compare
Contributor
Author
|
/retest |
yalzhang
force-pushed
the
update_pipefile
branch
5 times, most recently
from
February 26, 2026 02:36
7e815ab to
84c74b0
Compare
Enable hermetic builds across all Tekton pipelines and fix build failures by vendoring git dependencies and pre-building build tools. Problem: Hermetic builds isolate the network during container builds, breaking: 1. Makefile's 'go install' commands for build tools (controller-gen, yq) 2. Cargo's git dependency fetching for compute-pcrs-lib from GitHub 3. Manual 'git clone' for reference-values repository All of these require network access which is unavailable in hermetic mode. Solution: 1. Add compute-pcrs and reference-values as git submodules at specific commits for reproducible builds 2. COPY submodules into build directory and patch Cargo.toml to use local path dependencies instead of git URLs 3. Pre-build Go tools using 'go build' (not 'go install') with dynamic version detection from go.mod 4. Pre-build Rust tools (kopium) from prefetched dependencies 5. Use 'cargo metadata --frozen --offline' to prevent network access during dependency resolution Changes: - Add git submodules: - compute-pcrs (commit 1e7b9f74) - provides compute-pcrs-lib for all components - reference-values (commit e296603) - provides reference values for compute-pcrs - Update all component Containerfiles: - COPY git submodules into build directory - Patch Cargo.toml to replace git URLs with local paths - Pre-build controller-gen and yq using 'go build' (not 'go install') - Pre-build kopium using 'cargo install' from prefetched deps - Use 'cargo metadata --frozen --offline' to avoid network access - Remove manual 'git clone' commands - Enable hermetic mode in all Tekton pipeline configurations - Configure dependency prefetching for gomod and cargo - Enable source image building for supply chain traceability Affects components: - attestation-key-register - compute-pcrs - confidential-cluster-operator (operator) - registration-server Signed-off-by: Yalan Zhang <yalzhang@redhat.com>
yalzhang
force-pushed
the
update_pipefile
branch
from
February 26, 2026 02:48
84c74b0 to
5f260a9
Compare
…hermetic builds Add clevis-pin-trustee as git submodule at commit 75015a58 and vendor it for hermetic builds. This resolves network access failures during builds when Cargo attempts to fetch the dependency from GitHub. Changes: - Add clevis-pin-trustee git submodule at 75015a580a738fe153b5592e16e920a7595c90c6 - Copy clevis-pin-trustee into build containers (operator, registration-server, attestation-key-register) - Patch Cargo.toml to use local path for clevis-pin-trustee-lib instead of git URL - Pre-set KOPIUM_VERSION environment variable from Cargo.lock before calling make - Prevents Makefile from evaluating its default KOPIUM_VERSION definition - Makefile's default uses 'cargo metadata' which requires network access to crates.io index - Extracted value automatically stays in sync with locked version in Cargo.lock This enables all four components (operator, registration-server, attestation-key-register, compute-pcrs) to build successfully in hermetic mode without network access. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Signed-off-by: Yalan Zhang <yalzhang@redhat.com>
yalzhang
marked this pull request as draft
February 26, 2026 03:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enable hermetic builds across all Tekton pipelines and fix build
failures by vendoring git dependencies and pre-building build tools.
Problem:
Hermetic builds isolate the network during container builds, breaking:
All of these require network access which is unavailable in hermetic mode.
Solution:
commits for reproducible builds
local path dependencies instead of git URLs
version detection from go.mod
during dependency resolution
Changes:
Affects components: