lifecycle v0.16.2

lifecycle v0.16.2

Welcome to v0.16.2, a beta release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.16.2.

Features

• Updates go to version 1.19.8
• Bump github.com/docker/docker from v23.0.1 to v23.0.4
• Bump github.com/moby/buildkit from 0.11.4 to v0.11.5
• Bump golang.org/x/sys from 0.6.0 to v0.7.0
• Bump github.com/opencontainers/runc to from v1.1.4 to v.1.1.7
• Bump google.golang.org/protobuf from v1.29.0 to v1.29.1

lifecycle v0.17.0-pre.1

lifecycle v0.17.0-pre.1

Welcome to v0.17.0-pre.1, a beta pre-release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.17.0-pre.1.

Features

• When using platform API 0.12 or greater, the lifecycle validates “targets” instead of stacks (#994, #1030, #1050, #1053, #1064 by @joe-kimmel-vmw, #1056 by @jabrown85, #1005 by @natalieparellano)
• (Experimental) When using platform API 0.12 or greater, the lifecycle supports run image extension with Dockerfiles, in addition to run image switching (#1011, #1014, #1022, #1055 by @natalieparellano, #1032 by @jabrown85)
  • A demo of the feature can be found here: buildpacks/docs#581
  • Run image extension is a work-in-progress - please open an issue or comment here to report issues
• (Experimental) When using platform API 0.12 or greater, the lifecycle supports export to OCI layout format on disk (#969 by @jjbustamante)
• Updates go to version 1.19.8

Chores

• Add layer metadata test as living doc (#1019 by @AidanDelaney)
• Make a single constructor for lifecycle inputs (#1009 by @natalieparellano)

lifecycle v0.16.1

lifecycle v0.16.1

Welcome to v0.16.1, a beta release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.16.1.

Features

• Updates go to version 1.19.7
• Bump golang.org/x/sys from 0.5.0 to 0.6.0 (#1029 by @dependabot)
• Bump golang.org/x/net from 0.5.0 to 0.7.0 (#1017 by @dependabot)
• Bump kaniko & docker and unpin deps (#1045 by @natalieparellano)

Bug Fixes

• Ignore PAX global header in tar extract (#1036 by @benri)
• Replace print with logger in image_cache.go, fixes formatting (#1012 by @harshalmittal4)
• Fix log message when run image not found (#1004 by @natalieparellano)

lifecycle v0.16.0

lifecycle v0.16.0

Welcome to v0.16.0, a beta release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.16.0.

Breaking Changes

• Platform and buildpack APIs less than 0.7 are considered deprecated and will become unsupported as of July 1, 2023 (#974 by @natalieparellano)
  • The lifecycle will output warnings when deprecated APIs are accessed (warnings can be silenced by setting CNB_DEPRECATION_MODE=quiet)
  • For information about how to migrate, consult the migration guides

Features

• The lifecycle ships with SBOM files describing the lifecycle and launcher binaries; when using platform API 0.11 or greater, SBOM files for the launcher are included in the exported image; SBOM files for the lifecycle can be downloaded by the platform before the build container exits (#944 by @omocquais-p)
• When using platform API 0.11 or greater, platform operators can specify build time environment variables using the /cnb/config/env directory (#962 by @samj1912)
• When using platform API 0.11 or greater, the rebaser accepts a -previous-image flag to allow rebasing by digest reference (#985 by @joeybrown-sf)
• When using platform API 0.11 or greater, the exporter accepts a -launcher-sbom flag to allow platforms to provide their own SBOM files (#963 by @natalieparellano and #984 by @joe-kimmel-vmw)
• The detector, when all buildpacks fail to detect, will print debug messages as info level to allow for easier debugging of failed builds (#975 by @natalieparellano)
• Updates go to version 1.19.5 (#973 by @natalieparellano)
• Updates dependencies (#978 by @natalieparellano)

Bug Fixes

• The lifecycle accepts a CNB_SKIP_LAYERS environment variable instead of CNB_ANALYZE_SKIP_LAYERS, to reflect the variable name declared in the platform specification (#981 by @joe-kimmel-vmw)

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@jabrown85, @jjbustamante, @joe-kimmel-vmw, @joeybrown-sf, @natalieparellano, @omocquais-p, @samj1912

lifecycle v0.16.0-rc.2

lifecycle v0.16.0-rc.2

Welcome to v0.16.0-rc.2, a beta pre-release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.16.0-rc.2.

Breaking Changes

• Platform and buildpack APIs less than 0.7 are considered deprecated and will become unsupported as of July 1, 2023 (#974 by @natalieparellano)
  • The lifecycle will output warnings when deprecated APIs are accessed (warnings can be silenced by setting CNB_DEPRECATION_MODE=quiet)
  • For information about how to migrate, consult the migration guides

Features

• The lifecycle ships with SBOM files describing the lifecycle and launcher binaries; when using platform API 0.11 or greater, SBOM files for the launcher are included in the exported image; SBOM files for the lifecycle can be downloaded by the platform before the build container exits (#944 by @omocquais-p)
• When using platform API 0.11 or greater, platform operators can specify build time environment variables using the /cnb/config/env directory (#962 by @samj1912)
• When using platform API 0.11 or greater, the rebaser accepts a -previous-image flag to allow rebasing by digest reference (#985 by @joeybrown-sf)
• When using platform API 0.11 or greater, the exporter accepts a -launcher-sbom flag to allow platforms to provide their own SBOM files (#963 by @natalieparellano and #984 by @joe-kimmel-vmw)
• The detector, when all buildpacks fail to detect, will print debug messages as info level to allow for easier debugging of failed builds (#975 by @natalieparellano)
• Updates go to version 1.19.5 (#973 by @natalieparellano)
• Updates dependencies (#978 by @natalieparellano)

Bug Fixes

• The lifecycle accepts a CNB_SKIP_LAYERS environment variable instead of CNB_ANALYZE_SKIP_LAYERS, to reflect the variable name declared in the platform specification (#981 by @joe-kimmel-vmw)

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@jabrown85, @jjbustamante, @joe-kimmel-vmw, @joeybrown-sf, @natalieparellano, @omocquais-p, @samj1912

lifecycle v0.15.3

lifecycle v0.15.3

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.15.3.

Features

• Updates go to version 1.19.4 (#986 by @natalieparellano)
• Updates dependencies (#986 by @natalieparellano)

lifecycle v0.16.0-rc.1

lifecycle v0.16.0-rc.1

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.16.0-rc.1.

Breaking Changes

• Platform and buildpack APIs less than 0.7 are considered deprecated and will become unsupported as of July 1, 2023 (#974 by @natalieparellano)
  • The lifecycle will output warnings when deprecated APIs are accessed (warnings can be silenced by setting CNB_DEPRECATION_MODE=quiet)
  • For information about how to migrate, consult the migration guides

Features

• The lifecycle ships with SBOM files describing the lifecycle and launcher binaries; when using platform API 0.11 or greater, SBOM files for the launcher are included in the exported image; SBOM files for the lifecycle can be downloaded by the platform before the build container exits (#944 by @omocquais-p)
• When using platform API 0.11 or greater, platform operators can specify build time environment variables using the /cnb/config/env.build directory (#962 by @samj1912)
• The detector, when all buildpacks fail to detect, will print debug messages as info level to allow for easier debugging of failed builds (#975 by @natalieparellano)
• When using platform API 0.11 or greater, the exporter accepts a -launcher-sbom flag to allow platforms to provide their own SBOM files (#963 by @natalieparellano)
• Updates go to version 1.19.4 (#973 by @natalieparellano)
• Updates dependencies (#978 by @natalieparellano)

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@jabrown85, @jjbustamante, @natalieparellano, @omocquais-p, @samj1912

lifecycle v0.15.2

lifecycle v0.15.2

Welcome to v0.15.2, a beta release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.15.2.

Features

• Updates go to version 1.18.8

Bug Fixes

• The extender will set $HOME for the provided user after build image extension (#964 by @natalieparellano)

lifecycle v0.15.1

lifecycle v0.15.1

Welcome to v0.15.1, a beta release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.15.1.

Features

• Updates dependencies (#951 and #942 by @natalieparellano)

Bug Fixes

• The builder serializes processes correctly in <layers>/config/metadata.toml (#946, #947, and #950 by @jabrown85 and @natalieparellano)

lifecycle v0.15.0

lifecycle v0.15.0

Welcome to v0.15.0, a beta release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.15.0.

Features

• When using platform API 0.10 or greater, the lifecycle provides experimental support for image extensions: experimental components that generate Dockerfiles that can be used to define build and runtime base images (#860 and #869 by @natalieparellano and #896 by @BarDweller, @jromero, and @natalieparellano)
• When using buildpack API 0.9 or greater, buildpacks should write command as a list of strings in launch.toml, instead of a single string; entries in command are arguments that are always provided to the process, whereas entries in args are default arguments that can be overridden by the end user if supported by the platform (#889 by @jabrown85)
• When using platform API 0.10 or greater, user-provided arguments override buildpack-provided default arguments, instead of being appended (#920 by @jabrown85 and #921 by @natalieparellano)

Bug Fixes

• When using platform API 0.10 or greater, the creator when passed -skip-restore will still restore store.toml (#929 by @natalieparellano)
• When using platform API 0.7 or greater, the creator logs the expected phase header for the analyze phase (#878 by @jromero)

Known Issues

• Vulnerability scanners such as grype may trigger on non-impactful CVEs:
  • GHSA-f3fp-gc8g-vw66 and GHSA-v95c-p5hm-xq8f for package github.com/opencontainers/runc: non-impactful as the lifecycle does not create containers; the lifecycle cannot update runc until github.com/GoogleContainerTools/kaniko updates to a compatible version
  • CVE-2015-5237 and CVE-2021-22570 for package google.golang.org/protobuf: false positives (see .grype.yaml in project root for further information)

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors: @BarDweller, @jabrown85, @jromero, @mboldt, @natalieparellano