Skip to content

chore(deps): update konflux references #2920

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
red-hat-konflux wants to merge 1 commit into
base: master
Choose a base branch
from
+68 −32
Open

chore(deps): update konflux references #2920

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 34 additions & 16 deletions .tekton/compliance-backend-pull-request.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ spec:
- name: name
value: show-sbom
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:8fe70a95c28b1ac92abd67a7477ad960218f3f570a9f8a12ad082dff7e9c9579
value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.2@sha256:5fe387642611a8193395adb083df203534c30fef88a032ba0c074b8280c4b135
- name: kind
value: task
resolver: bundles
Expand Down Expand Up @@ -124,6 +124,18 @@ spec:
type: string
default: .
description: Target directories to scan with SAST tools. Multiple values should be separated with commas.
- name: source-date-epoch
type: string
default: ''
description: Sets the image created time and the SOURCE_DATE_EPOCH build argument. On its own, it does not change file timestamps inside the layers (set rewrite-timestamp to "true" for that). Leave empty to keep the actual build time.
- name: rewrite-timestamp
type: string
default: 'false'
description: When "true", clamp file modification times in the image layers to at most source-date-epoch. Does nothing unless source-date-epoch is set.
- name: omit-history
type: string
default: 'false'
description: When "true", omit the build history (history timestamps, layer metadata, etc.) from the resulting image.
Comment on lines +127 to +138

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu

for f in .tekton/compliance-backend-pull-request.yaml .tekton/compliance-backend-push.yaml; do
  echo "=== $f: parameter declarations ==="
  sed -n '115,145p' "$f"
  echo "=== $f: source-date-epoch and rewrite-timestamp usages ==="
  rg -n -C 5 'source-date-epoch|rewrite-timestamp|omit-history|commit-timestamp|clone-repository' "$f"
done

echo "=== clone-repository result declarations and task references ==="
rg -n -C 8 'name: clone-repository|commit-timestamp|results:' .tekton

Repository: RedHatInsights/compliance-backend

Length of output: 15873

🏁 Script executed:

#!/bin/bash
set -eu

for f in .tekton/compliance-backend-pull-request.yaml .tekton/compliance-backend-push.yaml; do
  echo "=== $f: clone and build-image-index task definitions ==="
  sed -n '145,275p' "$f"
done

echo "=== repository-wide commit-timestamp references ==="
rg -n -S 'commit-timestamp|SOURCE_DATE_EPOCH|REWRITE_TIMESTAMP|OMIT_HISTORY' . --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' || true

echo "=== pipeline parameter defaults and substitutions ==="
rg -n -C 3 'default:.*\\$\\(|\\$\\(tasks\\..*results|params.source-date-epoch' .tekton

Repository: RedHatInsights/compliance-backend

Length of output: 9449

🌐 Web query:

Konflux reproducible container builds ADR 0069 source-date-epoch commit-timestamp rewrite-timestamp Tekton

💡 Result:

Architecture Decision Record (ADR) 0069, "Reproducible Container Builds in Konflux," outlines the strategy for ensuring that identical source commits produce consistent container image digests within the Konflux CI platform [1][2]. The core of this strategy relies on addressing non-deterministic timestamps and file modification times (mtimes) during the build process [3]. To achieve bit-wise reproducibility, Konflux employs the following mechanisms: 1. SOURCE_DATE_EPOCH: This standardized environment variable [4][5] is propagated to the build environment [3]. The Konflux pipeline extracts the git commit timestamp from the source repository and wires it to the SOURCE_DATE_EPOCH parameter [3]. This ensures that embedded timestamps in the container metadata (such as the "Created" field) are clamped to the commit time rather than the actual build time [3][5]. 2. --rewrite-timestamp: Simply setting SOURCE_DATE_EPOCH is often insufficient for full bit-wise reproducibility because build tools may still preserve original file mtimes inside image layers [3]. Enabling the --rewrite-timestamp option (typically used with tools like buildah) forces these timestamps to be clamped to the value provided by SOURCE_DATE_EPOCH, ensuring that the resulting layer contents are deterministic [3][4]. 3. Tekton Integration: These parameters are configured within the Tekton-based pipelines that run on Konflux [3][6]. The build-container tasks are updated to accept and utilize these variables [3]. Additionally, Konflux may use specific build-side options (such as those being integrated into the konflux-build-cli) to properly handle label and layer generation [2]. ADR 0069 also identifies further requirements for holistic reproducibility, such as sorting multi-arch manifest indexes to prevent non-deterministic ordering of image manifests [2][7]. Beyond these technical build-time flags, Konflux also encourages the use of hermetic builds (via tools like Hermeto) to ensure dependencies are pinned and fetched deterministically [8], and it provides guidance on using commit-based timestamps versus actual build-time timestamps for image labels to balance reproducibility needs with operational requirements [9].

Citations:

🌐 Web query:

"git-clone-oci-ta" "commit-timestamp" Konflux

💡 Result:

In Konflux, git-clone-oci-ta is a specialized variant of the standard git-clone Tekton Task designed to support Trusted Artifacts [1]. It enables the secure sharing of source code files between Pipeline Tasks via OCI storage rather than traditional Persistent Volume Claims [1]. The commit-timestamp result is a piece of metadata provided by the git-clone-oci-ta Task that represents the timestamp of the Git commit currently checked out [2]. This result is primarily used to facilitate reproducible container builds and to provide accurate metadata for container images [3][4]. By passing this value into the SOURCE_DATE_EPOCH parameter of subsequent build Tasks (such as buildah-oci-ta), the build process can clamp file modification times and metadata timestamps to the commit time, which helps ensure that identical source code produces identical (bit-wise reproducible) container image digests [4]. Additionally, the commit-timestamp is often used in labeling and tagging strategies, such as setting the build-date label or creating unique image tags based on the time the source was committed [5][3]. Top Results: [6][1][5][3][4][2]

Citations:

🌐 Web query:

"buildah-oci-ta" "SOURCE_DATE_EPOCH" "REWRITE_TIMESTAMP"

💡 Result:

The --source-date-epoch and --rewrite-timestamp flags are features introduced in Buildah (v1.41.0) to facilitate reproducible container builds by mitigating non-determinism in image creation [1][2][3]. --source-date-epoch seconds This flag sets the created timestamp for the built image to the specified number of seconds since the Unix epoch [4][5]. It defaults to the value of the SOURCE_DATE_EPOCH environment variable if set, or the current time otherwise [5][6]. When used, it also sets a SOURCE_DATE_EPOCH build argument and forces output from the --output flag to bear this timestamp [4][1][7]. Additionally, when this or the --timestamp flag is enabled, Buildah uses fixed values for hostnames and container IDs during the build process to ensure greater determinism [8]. --rewrite-timestamp This flag works in conjunction with --source-date-epoch [1][7]. When enabled, it "clamps" the timestamps of newly added layer content, ensuring that no file or directory bears a timestamp later than the value provided by --source-date-epoch [4][5][9]. If no --source-date-epoch is provided, this flag has no effect [1][7]. To achieve a reproducible build, these flags are typically used together in the build command (e.g., buildah bud --source-date-epoch=${SOURCE_DATE_EPOCH} --rewrite-timestamp...) [9][10]. Using these flags allows for identical container images to be generated from the same inputs at different times, resulting in consistent image digests [4][9].

Citations:

🌐 Web query:

Tekton variable substitution default fallback task result parameter syntax

💡 Result:

In Tekton, there is no built-in "fallback" or "default" syntax directly within the variable substitution string (e.g., $(results.name.path:-default)) [1]. Variable substitution is a simple string replacement mechanism performed by the Tekton controller; if a variable cannot be evaluated, it typically remains as written or results in an error if the resolution fails [1]. However, you can achieve default values for Task results using the TEP-0048 feature, which allows you to define a default value directly in the Task result declaration [2]. 1. Default Value for Task Results (TEP-0048) If you enable the enable-default-results alpha feature flag, you can specify a default field in your Task's results definition [2]. If a task fails to produce a result, or is skipped, Tekton will use this default value instead of failing the pipeline [2]. Example: spec: results: - name: merge-strategy type: string default: "rebase" 2. Default Value for Parameters For standard Task parameters (not results), you can define a default value in the parameter declaration itself [3][4]. If no value is provided at runtime (e.g., via TaskRun or PipelineRun), Tekton uses the specified default [3][4]. Example: spec: params: - name: input default: "No input provided" If you are looking for shell-like behavior (e.g., ${VAR:-default}) directly inside your substitution, this is not currently supported natively by the Tekton controller's variable substitution syntax [1]. Users are generally expected to handle such logic within the script of their task or by using the built-in result/parameter default mechanisms described above [2][4].

Citations:

🏁 Script executed:

#!/bin/bash
set -eu

urls=(
  "https://raw.githubusercontent.com/konflux-ci/build-definitions/main/tasks/git-clone-oci-ta/README.md"
  "https://raw.githubusercontent.com/konflux-ci/build-definitions/main/tasks/buildah-oci-ta/README.md"
  "https://raw.githubusercontent.com/konflux-ci/build-definitions/main/pipelines/docker-build-oci-ta/README.md"
  "https://raw.githubusercontent.com/konflux-ci/build-definitions/main/pipelines/docker-build/README.md"
)

for url in "${urls[@]}"; do
  echo "=== $url ==="
  curl -fsSL "$url" | rg -n -C 4 'commit-timestamp|SOURCE_DATE_EPOCH|REWRITE_TIMESTAMP|rewrite-timestamp|source-date-epoch' || true
done

echo "=== git-clone-oci-ta references in build-definitions ==="
curl -fsSL "https://api.github.com/repos/konflux-ci/build-definitions/git/trees/main?recursive=1" |
  jq -r '.tree[].path' |
  rg 'git-clone-oci-ta|buildah-oci-ta|docker-build'

Repository: RedHatInsights/compliance-backend

Length of output: 13472

🏁 Script executed:

#!/bin/bash
set -u

echo "=== upstream docker-build-oci-ta directory links ==="
curl -fsSL "https://github.com/konflux-ci/build-definitions/tree/main/pipelines/docker-build-oci-ta" |
  rg -o 'href="[^"]+"' |
  sed 's/^href="//; s/"$//' |
  rg 'docker-build-oci-ta|README|yaml' | sort -u || true

echo "=== upstream docker-build-oci-ta YAML candidates ==="
for path in \
  pipelines/docker-build-oci-ta/docker-build-oci-ta.yaml \
  pipelines/docker-build-oci-ta/pipeline.yaml \
  pipelines/docker-build-oci-ta/docker-build-oci-ta.yml \
  tasks/git-clone-oci-ta/0.2/git-clone-oci-ta.yaml \
  tasks/buildah-oci-ta/0.10/buildah-oci-ta.yaml; do
  url="https://raw.githubusercontent.com/konflux-ci/build-definitions/main/$path"
  status=$(curl -L -s -o /tmp/upstream-file -w '%{http_code}' "$url")
  echo "$status $path"
  if [ "$status" = 200 ]; then
    rg -n -C 5 'commit-timestamp|SOURCE_DATE_EPOCH|REWRITE_TIMESTAMP|source-date-epoch' /tmp/upstream-file || true
  fi
done

echo "=== local occurrences, including callers ==="
rg -n -S 'source-date-epoch|commit-timestamp' . --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' || true

Repository: RedHatInsights/compliance-backend

Length of output: 2666

🌐 Web query:

site:github.com/konflux-ci/build-definitions "commit-timestamp" "source-date-epoch"

💡 Result:

SOURCE_DATE_EPOCH is a standardized environment variable used in software development to enable reproducible builds by providing a single, fixed point in time for build artifacts [1][2][3]. In the context of CI/CD pipelines (such as those used in Konflux or other container-building workflows), commit-timestamp and SOURCE_DATE_EPOCH are often linked to ensure that builds derived from a specific version of source code are deterministic [1]. 1. Function: By setting SOURCE_DATE_EPOCH to the Unix timestamp of the relevant git commit, build tools can use this value to normalize timestamps in generated files (such as container image layers, file modification times, and image metadata) [1][2]. 2. Reproducibility: Without a fixed timestamp, builds performed at different times will generate different binary outputs (e.g., different image digests) due to variations in creation dates or file mtimes [1]. Using the commit-timestamp as the SOURCE_DATE_EPOCH ensures that identical source code produces bit-identical artifacts [1]. 3. Workflow Usage: In many automated build tasks, the commit-timestamp is extracted from the git repository during checkout and then passed as the value for the SOURCE_DATE_EPOCH environment variable [1][2]. Tools like buildah or other OCI image builders use this variable to clamp file modification times (often when paired with flags like --rewrite-timestamp) and set the creation time of images [1][2][3]. In summary, commit-timestamp provides the reference time, and SOURCE_DATE_EPOCH acts as the standard interface used by build tools to adopt that reference time for deterministic, reproducible results [1].

Citations:

🏁 Script executed:

python3 - <<'PY'
from pathlib import Path
import re

files = [
    Path(".tekton/compliance-backend-pull-request.yaml"),
    Path(".tekton/compliance-backend-push.yaml"),
]

for path in files:
    text = path.read_text()
    assert re.search(
        r"- name: source-date-epoch\s+type: string\s+default: ''",
        text,
    ), path
    assert re.search(
        r"- name: rewrite-timestamp\s+type: string\s+default: 'false'",
        text,
    ), path
    assert "- name: SOURCE_DATE_EPOCH\n        value: $(params.source-date-epoch)" in text, path
    assert "value: $(tasks.clone-repository.results.commit-timestamp)" not in text, path
    assert "value: git-clone-oci-ta" in text, path
    assert "task-git-clone-oci-ta:0.2.5@" in text, path
    print(f"{path}: empty epoch default, rewrite disabled by default, build receives the parameter, no timestamp fallback")

print("Both manifests expose the same unresolved fallback.")
PY

Repository: RedHatInsights/compliance-backend

Length of output: 511

Use the clone commit timestamp as the SOURCE_DATE_EPOCH fallback in both pipelines.

When source-date-epoch is empty and rewrite-timestamp is true, ensure build-container receives $(tasks.clone-repository.results.commit-timestamp). Preserve an explicitly supplied epoch. Resolve this choice before invoking buildah-oci-ta, because Tekton has no inline conditional fallback. Without this fallback, rewrite-timestamp has no effect.

📍 Affects 2 files
  • .tekton/compliance-backend-pull-request.yaml#L127-L138 (this comment)
  • .tekton/compliance-backend-push.yaml#L111-L122

results:
- description: ""
name: IMAGE_URL
Expand All @@ -147,7 +159,7 @@ spec:
- name: name
value: init
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08
value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:b8465d543589b1238f6911626657f5766e279a0f33a5f70de68073401e031184
- name: kind
value: task
resolver: bundles
Expand All @@ -168,7 +180,7 @@ spec:
- name: name
value: git-clone-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2@sha256:e5ba1f8549e6a0f043629ef00bea7511957121e05304b688f40ff12304560f38
value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.5@sha256:510daad5648d37936b9b2c599a35c8e59b7389de8e1a4e58f6c6d079957d730d
- name: kind
value: task
resolver: bundles
Expand All @@ -194,7 +206,7 @@ spec:
- name: name
value: prefetch-dependencies-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:92956e75cd4714286f9c0c043f5301d1c0df1d750884edeceee87e0a91cc1975
value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.6.0@sha256:01158b939522c276ba36804c2cc7ef641a572fb6c27f001819ea287dd708cd13
- name: kind
value: task
resolver: bundles
Expand Down Expand Up @@ -234,14 +246,20 @@ spec:
value: $(tasks.init.results.http-proxy)
- name: NO_PROXY
value: $(tasks.init.results.no-proxy)
- name: SOURCE_DATE_EPOCH
value: $(params.source-date-epoch)
- name: REWRITE_TIMESTAMP
value: $(params.rewrite-timestamp)
- name: OMIT_HISTORY
value: $(params.omit-history)
Comment on lines +249 to +254

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
for f in .tekton/compliance-backend-pull-request.yaml .tekton/compliance-backend-push.yaml; do
  echo "===== $f: parameter and task sections ====="
  rg -n -C 5 'source-date-epoch|rewrite-timestamp|omit-history|sbom|signature|attestation|dockerfile|artifact|referrer|digest' "$f" || true
done
echo "===== related tracked files ====="
git ls-files | rg '(^|/)(\.tekton|tekton|pipeline|task|sbom|attest|dockerfile|compliance)' | head -200
echo "===== repository-wide consumers and artifact terms ====="
rg -n -i 'source-date-epoch|rewrite-timestamp|omit-history|secondary.artifact|oci referrer|referrer|sbom|signature|attestation|dockerfile' --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' . | head -300

Repository: RedHatInsights/compliance-backend

Length of output: 27083

🏁 Script executed:

#!/bin/bash
set -eu
for f in .tekton/compliance-backend-pull-request.yaml .tekton/compliance-backend-push.yaml; do
  echo "===== $f: tasks 120-540 ====="
  sed -n '120,540p' "$f"
done
echo "===== remote references in the repository ====="
rg -n 'pipeline-docker-build-oci-ta|task-show-sbom|task-push-dockerfile-oci-ta|build-container|build-image-index' .tekton README.md AGENTS.md 2>/dev/null || true
echo "===== ADR source candidates ====="
for u in \
  "https://konflux-ci.dev/architecture/ADR/0069-reproducible-container-builds/" \
  "https://raw.githubusercontent.com/konflux-ci/architecture/main/ADR/0069-reproducible-container-builds.md" \
  "https://raw.githubusercontent.com/konflux-ci/architecture/main/ADR/0069-reproducible-container-builds.adoc"; do
  echo "URL: $u"
  curl -LfsS --max-time 20 "$u" 2>/dev/null | head -200 || true
done
echo "===== public task source candidates ====="
for u in \
  "https://api.github.com/search/code?q=task-push-dockerfile-oci-ta+org%3Akonflux-ci" \
  "https://api.github.com/search/code?q=task-show-sbom+org%3Akonflux-ci"; do
  echo "URL: $u"
  curl -LfsS --max-time 20 "$u" 2>/dev/null | head -80 || true
done

Repository: RedHatInsights/compliance-backend

Length of output: 50389

🏁 Script executed:

#!/bin/bash
set -eu
echo "===== ADR secondary-artifact references ====="
curl -LfsS --max-time 20 \
  https://raw.githubusercontent.com/konflux-ci/architecture/main/ADR/0069-reproducible-container-builds.md |
  rg -n -C 8 'secondary|SBOM|attestation|signature|collision|referrer|digest|tag' | head -240

echo "===== build-definitions repository paths ====="
curl -LfsS --max-time 30 \
  'https://api.github.com/repos/konflux-ci/build-definitions/git/trees/main?recursive=1' |
  jq -r '.tree[]?.path' |
  rg -i 'show.?sbom|push.?dockerfile|dockerfile.*oci|sbom|attest|signature' | head -240

echo "===== GitHub repository search via commits and contents ====="
for p in \
  "task/show-sbom/0.2/show-sbom.yaml" \
  "task/push-dockerfile-oci-ta/0.3.1/push-dockerfile-oci-ta.yaml" \
  "tasks/show-sbom/0.2/show-sbom.yaml" \
  "tasks/push-dockerfile-oci-ta/0.3.1/push-dockerfile-oci-ta.yaml"; do
  u="https://raw.githubusercontent.com/konflux-ci/build-definitions/main/$p"
  echo "URL: $u"
  curl -LfsS --max-time 20 "$u" 2>/dev/null | head -160 || true
done

Repository: RedHatInsights/compliance-backend

Length of output: 29671

🏁 Script executed:

#!/bin/bash
set -eu
registry="quay.io"
repo="konflux-ci/tekton-catalog"
for ref in \
  "task-push-dockerfile-oci-ta@sha256:5393bada94051f02aa971ff773b130928e01ac595b9ce3bbbd69899751ed8222" \
  "pipeline-docker-build-oci-ta@sha256:0000000000000000000000000000000000000000000000000000000000000000"; do
  name="${ref%@*}"
  digest="${ref#*@}"
  echo "===== $name $digest ====="
  curl -LfsS --max-time 30 \
    -H 'Accept: application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.index.v1+json' \
    "https://${registry}/v2/${repo}/${name}/manifests/${digest}" |
    jq '{schemaVersion,mediaType,config,layers,manifests}'
done

Repository: RedHatInsights/compliance-backend

Length of output: 1142

🏁 Script executed:

#!/bin/bash
set -eu
registry="quay.io"
repo="konflux-ci/tekton-catalog"
name="task-push-dockerfile-oci-ta"
digest="sha256:5393bada94051f02aa971ff773b130928e01ac595b9ce3bbbd69899751ed8222"
manifest="$(curl -LfsS --max-time 30 \
  -H 'Accept: application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json' \
  "https://${registry}/v2/${repo}/${name}/manifests/${digest}")"
echo "===== config ====="
config_digest="$(printf '%s' "$manifest" | jq -r '.config.digest')"
curl -LfsS --max-time 30 "https://${registry}/v2/${repo}/${name}/blobs/${config_digest}" | jq .
echo "===== layer file list ====="
layer_digest="$(printf '%s' "$manifest" | jq -r '.layers[0].digest')"
curl -LfsS --max-time 30 "https://${registry}/v2/${repo}/${name}/blobs/${layer_digest}" | tar -tzf -
echo "===== relevant task content ====="
curl -LfsS --max-time 30 "https://${registry}/v2/${repo}/${name}/blobs/${layer_digest}" |
  tar -xOzf - 2>/dev/null |
  rg -n -C 5 'dockerfile|IMAGE_DIGEST|IMAGE_URL|oci|tag|referrer|cosign|oras|skopeo|push' || true

Repository: RedHatInsights/compliance-backend

Length of output: 3853

🏁 Script executed:

#!/bin/bash
set -eu
for f in .tekton/compliance-backend-pull-request.yaml .tekton/compliance-backend-push.yaml; do
  echo "===== $f: header and finalizers ====="
  sed -n '1,120p' "$f"
done

echo "===== konflux-build-cli branch ====="
git ls-remote --symref https://github.com/konflux-ci/konflux-build-cli.git HEAD refs/heads/main refs/heads/master 2>/dev/null | head -10

echo "===== konflux-build-cli source candidates ====="
python3 - <<'PY'
import io, json, re, subprocess, tarfile, urllib.request
repo = "https://github.com/konflux-ci/konflux-build-cli"
branch = "main"
try:
    raw = subprocess.check_output(
        ["git", "ls-remote", "--symref", repo + ".git", "HEAD"],
        text=True, stderr=subprocess.DEVNULL)
    m = re.search(r"refs/heads/([^\s]+)", raw)
    if m:
        branch = m.group(1)
except Exception:
    pass
url = f"https://codeload.github.com/konflux-ci/konflux-build-cli/tar.gz/refs/heads/{branch}"
data = urllib.request.urlopen(url, timeout=30).read()
tf = tarfile.open(fileobj=io.BytesIO(data), mode="r:gz")
matches = []
for member in tf.getmembers():
    if not member.isfile():
        continue
    name = member.name.lower()
    if any(x in name for x in ("containerfile", "dockerfile", "push-container", "push_container")):
        text = tf.extractfile(member).read().decode("utf-8", "replace")
        matches.append((member.name, text))
print("branch:", branch)
print("matches:", [n for n, _ in matches])
for name, text in matches:
    hits = [f"{i+1}:{line}" for i, line in enumerate(text.splitlines())
            if re.search(r"tag.?suffix|image.?digest|dockerfile|containerfile|referrer|oras|sha256[-_]", line, re.I)]
    if hits:
        print(f"--- {name} ---")
        print("\n".join(hits[:160]))
PY

Repository: RedHatInsights/compliance-backend

Length of output: 12868

🏁 Script executed:

#!/bin/bash
set -eu
echo "===== konflux-build-cli source candidates ====="
curl -ksLf --max-time 40 \
  https://codeload.github.com/konflux-ci/konflux-build-cli/tar.gz/refs/heads/main |
python3 - <<'PY'
import io, re, sys, tarfile
data = sys.stdin.buffer.read()
tf = tarfile.open(fileobj=io.BytesIO(data), mode="r:gz")
for member in tf.getmembers():
    if not member.isfile():
        continue
    name = member.name.lower()
    if any(x in name for x in ("containerfile", "dockerfile", "push-container", "push_container")):
        text = tf.extractfile(member).read().decode("utf-8", "replace")
        hits = [f"{i+1}:{line}" for i, line in enumerate(text.splitlines())
                if re.search(r"tag.?suffix|image.?digest|dockerfile|containerfile|referrer|oras|cosign|sha256[-_]|push-container", line, re.I)]
        if hits:
            print(f"--- {member.name} ---")
            print("\n".join(hits[:200]))
PY

echo "===== deterministic collision check ====="
python3 - <<'PY'
def dockerfile_tag(image_digest, suffix=".dockerfile"):
    # This models the task contract: IMAGE_DIGEST constructs the artifact tag,
    # and TAG_SUFFIX supplies the artifact suffix.
    return f"sha256-{image_digest.removeprefix('sha256:')}{suffix}"

digest = "sha256:" + "a" * 64
first = dockerfile_tag(digest)
second = dockerfile_tag(digest)
print({"first": first, "second": second, "collision": first == second})
assert first == second
PY

Repository: RedHatInsights/compliance-backend

Length of output: 1466

🏁 Script executed:

#!/bin/bash
set -eu
python3 - <<'PY'
import io, json, subprocess, tarfile

registry = "quay.io"
repo = "konflux-ci/tekton-catalog"
name = "task-push-dockerfile-oci-ta"
digest = "sha256:5393bada94051f02aa971ff773b130928e01ac595b9ce3bbbd69899751ed8222"

def curl(url, *args):
    return subprocess.check_output(
        ["curl", "-ksLf", "--max-time", "30", *args, url]
    )

manifest = json.loads(curl(
    f"https://{registry}/v2/{repo}/{name}/manifests/{digest}",
    "-H", "Accept: application/vnd.docker.distribution.manifest.v2+json"
))
layer = manifest["layers"][0]["digest"]
bundle = curl(f"https://{registry}/v2/{repo}/{name}/blobs/{layer}")
tf = tarfile.open(fileobj=io.BytesIO(bundle), mode="r:gz")
task = json.loads(tf.extractfile(tf.getmembers()[0]).read())

params = {p["name"]: p for p in task["spec"]["params"]}
step_args = task["spec"]["steps"][1]["args"]
assert "IMAGE_DIGEST" in params
assert "used to construct the tag" in params["IMAGE_DIGEST"]["description"]
assert "--image-digest" in step_args
assert "--tag-suffix" in step_args
suffix = params["TAG_SUFFIX"]["default"]
assert suffix == ".dockerfile"

def artifact_tag(primary_digest):
    return "sha256-" + primary_digest.removeprefix("sha256:") + suffix

digest_a = "sha256:" + "a" * 64
digest_b = "sha256:" + "a" * 64
tag_a = artifact_tag(digest_a)
tag_b = artifact_tag(digest_b)
print({
    "image_digest_contract": params["IMAGE_DIGEST"]["description"],
    "tag_suffix": suffix,
    "tag_a": tag_a,
    "tag_b": tag_b,
    "same_digest_same_tag": tag_a == tag_b,
})
assert tag_a == tag_b
PY

Repository: RedHatInsights/compliance-backend

Length of output: 536

Make Dockerfile artifact tags collision-safe in both pipelines.

push-dockerfile-oci-ta:0.3.1 derives the .dockerfile tag from IMAGE_DIGEST. Reproducible runs with the same digest overwrite the same artifact. Use a per-run identity or OCI referrers. Apply the same contract to SBOM, signature, and attestation publishers.

  • .tekton/compliance-backend-pull-request.yaml#L249-L254
  • .tekton/compliance-backend-push.yaml#L226-L231
📍 Affects 2 files
  • .tekton/compliance-backend-pull-request.yaml#L249-L254 (this comment)
  • .tekton/compliance-backend-push.yaml#L226-L231

runAfter:
- prefetch-dependencies
taskRef:
params:
- name: name
value: buildah-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.10@sha256:daa9a28265b8d92033ac94f610ff6bc3135e1b2cbf65076af74a76dd940a46a9
value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.10.7@sha256:f07fccbe8d952ba2e9e5f3b8b8bfcda2cc8037d5153cf19da7d5ed0bb8b431a8
- name: kind
value: task
resolver: bundles
Expand All @@ -263,7 +281,7 @@ spec:
- name: name
value: build-image-index
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:70c52e88e737340e7b58418fda38c13273aa7cdf587b825778e3560aca1d1133
value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:a355355b7fcd0ba8de4ba85a162a2e6893f53236b943f79cb03ae0ae9c5ef53c
- name: kind
value: task
resolver: bundles
Expand All @@ -284,7 +302,7 @@ spec:
- name: name
value: source-build-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:2dd5b3e88f2ff3ea5679dfae07a14ee840b828610edd0c2e1ff2d8b25e808fe2
value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:6081c4167e87a9167f7db4cda9ff0110607b7b9fc404c3daa076247475a4affa
- name: kind
value: task
resolver: bundles
Expand Down Expand Up @@ -312,7 +330,7 @@ spec:
- name: name
value: sast-shell-check-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:f6a115eb88640f65d6c0e404c55cdd315755577fedf9958c4efd9af5180f6fc3
value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:61b27e6ad5daba761d41bb37efb790ed98380603fd4fe2f86d156def5bd72ecc
- name: kind
value: task
resolver: bundles
Expand Down Expand Up @@ -340,7 +358,7 @@ spec:
- name: name
value: sast-unicode-check-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:4961c44d6475f0343fe73c556a44204daa85d8c47e23f98d723255d1ff98271d
value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:eb9d5392f215cb8b52b16382098cac4885b1e6cd989f88ebd83fdb234d283eb9
- name: kind
value: task
resolver: bundles
Expand All @@ -362,7 +380,7 @@ spec:
- name: name
value: deprecated-image-check
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e
value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872
- name: kind
value: task
resolver: bundles
Expand All @@ -384,7 +402,7 @@ spec:
- name: name
value: clair-scan
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9ff424d913dd7681031a93d8bdbed622cd5536633f8ed0dbb4a9021055cf9d21
value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3.2@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174
- name: kind
value: task
resolver: bundles
Expand All @@ -404,7 +422,7 @@ spec:
- name: name
value: ecosystem-cert-preflight-checks
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:2e5ebe0b462fd19d85ad314f2709a27b905b729046b5d9bce282b10d333e9d6c
value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:27c9760ad11c74ad010d9615ee15348e3674843166acb7686929b3ef6840416c
- name: kind
value: task
resolver: bundles
Expand Down Expand Up @@ -432,7 +450,7 @@ spec:
- name: name
value: sast-snyk-check-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:918327bfbf7237763e764f29f567bc92720955094311acfdd5a889b89282d683
value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:eba24f5d9f4b18aa71e523b9b3dbcf22982aa4b018824260a090b19dfc9abf6f
- name: kind
value: task
resolver: bundles
Expand All @@ -454,7 +472,7 @@ spec:
- name: name
value: clamav-scan
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217
value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.1@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217
- name: kind
value: task
resolver: bundles
Expand Down Expand Up @@ -499,7 +517,7 @@ spec:
- name: name
value: push-dockerfile-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:f3e97e6eaf09d6585e915c3e7b82d110d97e34202bf591a2d990127ba5bb362d
value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:5393bada94051f02aa971ff773b130928e01ac595b9ce3bbbd69899751ed8222
- name: kind
value: task
resolver: bundles
Expand All @@ -516,7 +534,7 @@ spec:
- name: name
value: rpms-signature-scan
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:2e79e4723f54e8fdefed4fe0f68ea789f2f71031385fc6352b6edf70d42690f6
value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.1@sha256:ccb77d1bf7627fc6241a59ed42bb6e5707a8682754fe8ae18f2cfdddbcf29275
- name: kind
value: task
resolver: bundles
Expand Down
50 changes: 34 additions & 16 deletions .tekton/compliance-backend-push.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ spec:
- name: name
value: show-sbom
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:8fe70a95c28b1ac92abd67a7477ad960218f3f570a9f8a12ad082dff7e9c9579
value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.2@sha256:5fe387642611a8193395adb083df203534c30fef88a032ba0c074b8280c4b135
- name: kind
value: task
resolver: bundles
Expand Down Expand Up @@ -108,6 +108,18 @@ spec:
type: string
default: .
description: Target directories to scan with SAST tools. Multiple values should be separated with commas.
- name: source-date-epoch
type: string
default: ''
description: Sets the image created time and the SOURCE_DATE_EPOCH build argument. On its own, it does not change file timestamps inside the layers (set rewrite-timestamp to "true" for that). Leave empty to keep the actual build time.
- name: rewrite-timestamp
type: string
default: 'false'
description: When "true", clamp file modification times in the image layers to at most source-date-epoch. Does nothing unless source-date-epoch is set.
- name: omit-history
type: string
default: 'false'
description: When "true", omit the build history (history timestamps, layer metadata, etc.) from the resulting image.
results:
- description: ""
name: IMAGE_URL
Expand All @@ -128,7 +140,7 @@ spec:
- name: name
value: init
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-init:0.4@sha256:5a423246792ac501ea279229b42ee57da9927da441c04b5c9ff86817b0856b08
value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:b8465d543589b1238f6911626657f5766e279a0f33a5f70de68073401e031184
- name: kind
value: task
resolver: bundles
Expand All @@ -149,7 +161,7 @@ spec:
- name: name
value: git-clone-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2@sha256:e5ba1f8549e6a0f043629ef00bea7511957121e05304b688f40ff12304560f38
value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.5@sha256:510daad5648d37936b9b2c599a35c8e59b7389de8e1a4e58f6c6d079957d730d
- name: kind
value: task
resolver: bundles
Expand All @@ -175,7 +187,7 @@ spec:
- name: name
value: prefetch-dependencies-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:92956e75cd4714286f9c0c043f5301d1c0df1d750884edeceee87e0a91cc1975
value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.6.0@sha256:01158b939522c276ba36804c2cc7ef641a572fb6c27f001819ea287dd708cd13
- name: kind
value: task
resolver: bundles
Expand Down Expand Up @@ -211,14 +223,20 @@ spec:
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
- name: BUILDAH_FORMAT
value: $(params.buildah-format)
- name: SOURCE_DATE_EPOCH
value: $(params.source-date-epoch)
- name: REWRITE_TIMESTAMP
value: $(params.rewrite-timestamp)
- name: OMIT_HISTORY
value: $(params.omit-history)
runAfter:
- prefetch-dependencies
taskRef:
params:
- name: name
value: buildah-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.10@sha256:daa9a28265b8d92033ac94f610ff6bc3135e1b2cbf65076af74a76dd940a46a9
value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.10.7@sha256:f07fccbe8d952ba2e9e5f3b8b8bfcda2cc8037d5153cf19da7d5ed0bb8b431a8
- name: kind
value: task
resolver: bundles
Expand All @@ -240,7 +258,7 @@ spec:
- name: name
value: build-image-index
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:70c52e88e737340e7b58418fda38c13273aa7cdf587b825778e3560aca1d1133
value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:a355355b7fcd0ba8de4ba85a162a2e6893f53236b943f79cb03ae0ae9c5ef53c
- name: kind
value: task
resolver: bundles
Expand All @@ -261,7 +279,7 @@ spec:
- name: name
value: source-build-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:2dd5b3e88f2ff3ea5679dfae07a14ee840b828610edd0c2e1ff2d8b25e808fe2
value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:6081c4167e87a9167f7db4cda9ff0110607b7b9fc404c3daa076247475a4affa
- name: kind
value: task
resolver: bundles
Expand Down Expand Up @@ -289,7 +307,7 @@ spec:
- name: name
value: sast-shell-check-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:f6a115eb88640f65d6c0e404c55cdd315755577fedf9958c4efd9af5180f6fc3
value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:61b27e6ad5daba761d41bb37efb790ed98380603fd4fe2f86d156def5bd72ecc
- name: kind
value: task
resolver: bundles
Expand Down Expand Up @@ -317,7 +335,7 @@ spec:
- name: name
value: sast-unicode-check-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:4961c44d6475f0343fe73c556a44204daa85d8c47e23f98d723255d1ff98271d
value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:eb9d5392f215cb8b52b16382098cac4885b1e6cd989f88ebd83fdb234d283eb9
- name: kind
value: task
resolver: bundles
Expand All @@ -339,7 +357,7 @@ spec:
- name: name
value: deprecated-image-check
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e
value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872
- name: kind
value: task
resolver: bundles
Expand All @@ -361,7 +379,7 @@ spec:
- name: name
value: clair-scan
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:9ff424d913dd7681031a93d8bdbed622cd5536633f8ed0dbb4a9021055cf9d21
value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3.2@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174
- name: kind
value: task
resolver: bundles
Expand All @@ -381,7 +399,7 @@ spec:
- name: name
value: ecosystem-cert-preflight-checks
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:2e5ebe0b462fd19d85ad314f2709a27b905b729046b5d9bce282b10d333e9d6c
value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:27c9760ad11c74ad010d9615ee15348e3674843166acb7686929b3ef6840416c
- name: kind
value: task
resolver: bundles
Expand Down Expand Up @@ -409,7 +427,7 @@ spec:
- name: name
value: sast-snyk-check-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:918327bfbf7237763e764f29f567bc92720955094311acfdd5a889b89282d683
value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:eba24f5d9f4b18aa71e523b9b3dbcf22982aa4b018824260a090b19dfc9abf6f
- name: kind
value: task
resolver: bundles
Expand All @@ -431,7 +449,7 @@ spec:
- name: name
value: clamav-scan
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217
value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.1@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217
- name: kind
value: task
resolver: bundles
Expand Down Expand Up @@ -476,7 +494,7 @@ spec:
- name: name
value: push-dockerfile-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3@sha256:f3e97e6eaf09d6585e915c3e7b82d110d97e34202bf591a2d990127ba5bb362d
value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:5393bada94051f02aa971ff773b130928e01ac595b9ce3bbbd69899751ed8222
- name: kind
value: task
resolver: bundles
Expand All @@ -493,7 +511,7 @@ spec:
- name: name
value: rpms-signature-scan
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:2e79e4723f54e8fdefed4fe0f68ea789f2f71031385fc6352b6edf70d42690f6
value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.1@sha256:ccb77d1bf7627fc6241a59ed42bb6e5707a8682754fe8ae18f2cfdddbcf29275
- name: kind
value: task
resolver: bundles
Expand Down
Loading