Repository navigation
Conversation
plone/plone stopped at 5.2.4 in March 2021. The official plone:5.2.14 was built by Docker Official Images from 5.2/5.2.14/debian in this repository, but that Dockerfile can no longer be rebuilt faithfully: bullseye-security now answers apt-get with 404s. Copy the official image by digest instead. mirror/official-tags.txt pins the eight official 5.2.14 tags to their manifest-list digest, and mirror/mirror-official.sh verifies the source digests, copies each tag with buildx imagetools create, and checks that every copy kept the digest. The mirror official workflow only verifies on pull requests and publishes when dispatched from main. latest, 5, 5.2 and python38 on plone/plone move from 5.2.4 to 5.2.14. Refs #210
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
plone/plonestops at 5.2.4 (March 2021). The officialplone:5.2.14was built by Docker Official Images from this repository's own5.2/5.2.14/debian(its manifest annotatesplone/plone.docker@a3a9c7e). That Dockerfile can't be rebuilt faithfully any more:apt-getnow gets 404s frombullseye-security.So this copies the released image by digest rather than rebuilding it:
mirror/official-tags.txtpins the eight official 5.2.14 tags (5.2.14,5.2.14-python38,5.2,5.2-python38,5,5-python38,python38,latest) to digestsha256:e73ae6e9….mirror/mirror-official.shchecks that each source tag still has its pinned digest, then copies it withdocker buildx imagetools createand checks that the copy kept the same digest. If an official tag moves, the run fails.mirror officialworkflow only runs the check on pull requests. It publishes toplone/ploneandghcr.io/plone/plone.dockeronly when dispatched frommain, and fails if the Docker Hub credentials are missing.What changes for users: after the publish,
plone/plone:latest,5,5.2andpython38point at 5.2.14 instead of 5.2.4.5-python38and5.2-python38are new tags. The official image is amd64 only, and so are these copies.Tested locally: a verify-only run passed for all 8 tags, and a run with a wrong digest failed. A publish into a throwaway local registry kept the source digest on all 16 copies (8 tags to 2 targets). The script and workflow pass shellcheck and actionlint.
After merge: run the
mirror officialworkflow frommain. Then update the 5.2 row inplone/documentation'sdocs/install/containers/images/historical.md(plone/documentation#2103).Refs #210