lifecycle v0.13.0-rc.1

lifecycle v0.13.0-rc.1

Welcome to v0.13.0-rc.1, a beta pre-release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.13.0-rc.1.

Features

• When using buildpack API 0.7 or greater, buildpacks may output Software Bill of Materials (SBOM) files with the application/vnd.cyclonedx+json, application/spdx+json, or application/vnd.syft+json media type (#749 by @aemengo)
• When using platform API 0.8 or greater, the exporter will include launch-associated SBOM files output by buildpacks as a layer in the application image. Build-associated SBOM files will be available to platforms in the <layers>/sbom/build directory. Cache-associated SBOM files will be cached and restored to the buildpack layers directory on re-builds of the same image (#749 by @aemengo)
• Use a newer version of the CycloneDX/gh-gomod-generate-sbom action for generating the lifecycle’s CycloneDX SBOM (#750 by @VinodAnandan)

Bug Fixes

• The lifecycle will not panic when run as a sub-command (#747 by @jabrown85)
• make lint will not panic when using Go 1.17 (#748 by @mboldt)
• The analyzer no longer outputs log warnings for inaccessible platform API 0.7+ features when running on an older platform (#757 by @natalieparellano)

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:
@VinodAnandan, @aemengo, @jabrown85, @mboldt, @natalieparellano, @samj1912, @sclevine