lifecycle v0.13.3

lifecycle v0.13.3

Welcome to v0.13.3, a beta release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.13.3.

Bug Fixes

• When using buildpack API 0.7 or greater, the builder will accept Bill of Materials (BOM) output in both the new files format and the legacy table format. This enables buildpacks to maintain backwards compatibility with older platforms (#794 by @aemengo)
• When using platform API 0.8 or greater, the restorer will copy launch-associated BOM files to the buildpack layers directory, even when no BOM files are in the cache (#798 by @natalieparellano)

lifecycle v0.13.2

lifecycle v0.13.2

Welcome to v0.13.2, a beta release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.13.2.

Bug fixes

• The creator when using a daemon will pass -launch-cache to the analyzer, to avoid downloading all layers from the previous image when restoring the sbom layer (#784 by @natalieparellano); note that slower performance still exists when the 5 phases are invoked separately (the "untrusted builder" workflow) - for more information, see buildpacks/spec#276

lifecycle v0.13.1

lifecycle v0.13.1

Welcome to v0.13.1, a beta release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.13.1.

Features

• Updates ggcr to version 0.7.0 (#774)
• Updates docker to version 20.10.11+incompatible (#769)

Bug Fixes

• For launch=true cache=false layers, layer sbom files are included in the exported image on second (and subsequent) builds (#773 by @natalieparellano)
• For launch=false cache=true layers, when using a cache directory, layer sbom files are restored from the cache and are included in /layers/sbom/build (#773 by @natalieparellano)
• For second (and subsequent) builds, when the creator is run with -skip-restore, /layers/sbom is cleared before the build phase, to avoid pollution from sboms for undetected buildpacks (#773 by @natalieparellano)
• The creator keeps daemon connection open using ping during build phase, to fix timeout errors when using podman (#684 by @matejvasek)
• Better error message when daemon connection is called in parallel (#779 by @matejvasek)

Chores

• The layer metadata restorer and the layer sha store are moved to an internal package (#724 by @yaelharel)

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:
@aemengo, @jabrown85, @matejvasek, @natalieparellano, @yaelharel

lifecycle v0.13.0

lifecycle v0.13.0

Welcome to v0.13.0, a beta release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.13.0.

Features

• When using buildpack API 0.7 or greater, buildpacks may output Software Bill of Materials (SBOM) files with the application/vnd.cyclonedx+json, application/spdx+json, or application/vnd.syft+json media type (#749 by @aemengo)
• When using platform API 0.8 or greater, the exporter will include launch-associated SBOM files output by buildpacks as a layer in the application image. Build-associated SBOM files will be available to platforms in the <layers>/sbom/build directory. Cache-associated SBOM files will be cached and restored to the buildpack layers directory on re-builds of the same image (#749 by @aemengo)
• Use a newer version of the CycloneDX/gh-gomod-generate-sbom action for generating the lifecycle’s CycloneDX SBOM (#750 by @VinodAnandan)

Bug Fixes

• The lifecycle will not panic when run as a sub-command (#747 by @jabrown85)
• make lint will not panic when using Go 1.17 (#748 by @mboldt)
• The analyzer no longer outputs log warnings for inaccessible platform API 0.7+ features when running on an older platform (#757 by @natalieparellano)

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:
@VinodAnandan, @aemengo, @jabrown85, @mboldt, @natalieparellano, @samj1912, @sclevine

lifecycle v0.13.0-rc.1

lifecycle v0.13.0-rc.1

Welcome to v0.13.0-rc.1, a beta pre-release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.13.0-rc.1.

Features

• When using buildpack API 0.7 or greater, buildpacks may output Software Bill of Materials (SBOM) files with the application/vnd.cyclonedx+json, application/spdx+json, or application/vnd.syft+json media type (#749 by @aemengo)
• When using platform API 0.8 or greater, the exporter will include launch-associated SBOM files output by buildpacks as a layer in the application image. Build-associated SBOM files will be available to platforms in the <layers>/sbom/build directory. Cache-associated SBOM files will be cached and restored to the buildpack layers directory on re-builds of the same image (#749 by @aemengo)
• Use a newer version of the CycloneDX/gh-gomod-generate-sbom action for generating the lifecycle’s CycloneDX SBOM (#750 by @VinodAnandan)

Bug Fixes

• The lifecycle will not panic when run as a sub-command (#747 by @jabrown85)
• make lint will not panic when using Go 1.17 (#748 by @mboldt)
• The analyzer no longer outputs log warnings for inaccessible platform API 0.7+ features when running on an older platform (#757 by @natalieparellano)

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:
@VinodAnandan, @aemengo, @jabrown85, @mboldt, @natalieparellano, @samj1912, @sclevine

lifecycle v0.12.0

lifecycle v0.12.0

Welcome to v0.12.0, a beta release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.12.0.

Features

• Initial support for arm64 (#659 and #680 by @imjasonh)
• When using platform API 0.7 or greater, the analyzer must be run before detector (#582 by @jabrown85)
• When using platform API 0.7 or greater, the analyzer will validate registry access (#646 by @jjbustamante)
• When using platform API 0.7 or greater, the -run-image flag is added to analyzer and removed from exporter (#662 by @natalieparellano)
• When using platform API 0.7 or greater, layer.sha files are not written after layer metadata restoration (#624 by @yaelharel)
• Release artifacts include checksums (#679 by @yaelharel)
• Lifecycle images are signed with cosign (#683 by @natalieparellano)
• Release artifacts include a CycloneDX SBOM; the SBOM is “attached” to the lifecycle image and signed with cosign (#690 and #701 by @natalieparellano)

Bug Fixes

• The restorer will apply the correct umask when extracting layers because archive.Extract is now thread safe (#730 by @yaelharel)
• Updates imgutil to provide better sparse images tars for podman (buildpacks/imgutil#128 by @matejvasek)
• The launcher, when encountering file errors, will show the underlying error to the end user (#641 by @phil9909)

Chores

• The lifecycle, when compiled for Linux, no longer requires an alpine container (#630 by @imjasonh, #689 by @natalieparellano)
• Acceptance tests are added for the builder (#648 by @haliliceylan)
• Acceptance tests for the analyzer use a custom docker registry to simplify testing image permissions (#685 by @jjbustamante)
• The lifecycle can be developed using Gitpod (#604 by @JanKoehnlein)

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@JanKoehnlein, @aemengo, @dwillist, @ekcasey, @haliliceylan, @imjasonh, @jabrown85, @jjbustamante, @matejvasek, @micahyoung, @natalieparellano, @phil9909, @samj1912, @soniasingla, @yaelharel

lifecycle v0.12.0-rc.1

lifecycle v0.12.0-rc.1

Welcome to v0.12.0-rc.1, a beta pre-release of the Cloud Native Buildpacks Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Lifecycle Image

An OCI image containing the lifecycle binaries is available at buildpacksio/lifecycle:0.12.0-rc.1.

Features

• Support for arm64 (#659 and #680 by @imjasonh)
• When using platform API 0.7 or greater, the analyzer must be run before detector (#582 by @jabrown85)
• When using platform API 0.7 or greater, the analyzer will validate registry access (#646 by @jjbustamante)
• When using platform API 0.7 or greater, the -run-image flag is added to analyzer and removed from exporter (#662 by @natalieparellano)
• When using platform API 0.7 or greater, layer.sha files are not written after layer metadata restoration (#624 by @yaelharel)
• Release artifacts include checksums (#679 by @yaelharel)
• Lifecycle images are signed with cosign (#683 by @natalieparellano)
• Release artifacts include a CycloneDX SBOM; the SBOM is “attached” to the lifecycle image and signed with cosign (#690 and #701 by @natalieparellano)

Bug Fixes

• The launcher, when encountering file errors, will show the underlying error to the end user (#641 by @phil9909)

Chores

• The lifecycle, when compiled for Linux, no longer requires an alpine container (#630 by @imjasonh, #689 by @natalieparellano)
• Acceptance tests are added for the builder (#648 by @haliliceylan)
• Acceptance tests for the analyzer use a custom docker registry to simplify testing image permissions (#685 by @jjbustamante)
• The lifecycle can be developed using Gitpod (#604 by @JanKoehnlein)

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@JanKoehnlein, @aemengo, @dwillist, @ekcasey, @haliliceylan, @imjasonh, @jabrown85, @jjbustamante, @micahyoung, @natalieparellano, @phil9909, @samj1912, @soniasingla, @yaelharel

lifecycle v0.11.4

lifecycle v0.11.4

Welcome to v0.11.4, a beta release of the Cloud Native Buildpack Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Bug Fixes

• The lifecycle when parsing a resolved registry auth header will not print the header when parsing failed (#664 by @natalieparellano, fixes #661)
• The detector will print buildpack output when parsing the output plan failed (#667 by @yaelharel, fixes #663)

lifecycle v0.11.3

lifecycle v0.11.3

Welcome to v0.11.3, a beta release of the Cloud Native Buildpack Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Bug Fixes

• Updates imgutil to avoid re-pulling image manifest on successful requests (buildpacks/imgutil#117 by @jjbustamante, fixes #613)

lifecycle v0.11.2

lifecycle v0.11.2

Welcome to v0.11.2, a beta release of the Cloud Native Buildpack Lifecycle.

Prerequisites

The lifecycle runs as a normal user in a series of unprivileged containers. To export images and cache image layers, it requires access to a Docker daemon or Docker registry.

Install

Extract the .tgz file and copy the lifecycle binaries into a build stack base image. The build image can then be orchestrated by a platform implementation such as the pack CLI or tekton.

Bug Fixes

• Fix caching for buildpacks that implement buildpack API 0.6 or greater (#592 by @natalieparellano and @yaelharel)