Merge branch 'main' into send-tar-hash

Author: jglogan

.github/workflows/pr-build.yml

@@ -8,6 +8,35 @@ on:
     types: [opened, reopened, synchronize]
 
 jobs:
+  verify-signatures:
+    name: Verify commit signatures
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check all commits are signed
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          commits=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/commits --paginate)
+          unsigned_commits=""
+
+          while IFS='|' read -r sha author verified; do
+            if [ "$verified" != "true" ]; then
+              unsigned_commits="$unsigned_commits  - $sha by $author\n"
+            fi
+          done < <(echo "$commits" | jq -r '.[] | "\(.sha)|\(.commit.author.name)|\(.commit.verification.verified)"')
+
+          if [ -n "$unsigned_commits" ]; then
+            echo "::error::The following commits are not signed:"
+            echo -e "$unsigned_commits"
+            echo ""
+            echo "Please sign your commits. See:"
+            echo  "  - https://github.com/apple/containerization/blob/main/CONTRIBUTING.md#pull-requests"
+            echo  "  - https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
+            exit 1
+          fi
+
+          echo "All commits are signed!"
+
   build:
     name: Invoke build
     uses: ./.github/workflows/common.yml

.github/workflows/pr-label-apply.yml

@@ -29,20 +29,12 @@ jobs:
           run-id: ${{ github.event.workflow_run.id }}
           pattern: pr-metadata-*
           merge-multiple: false
-        continue-on-error: true
         id: download-artifact
 
       - name: Read PR number
         id: pr-number
         run: |
-          METADATA_DIR=$(find . -type d -name "pr-metadata-*" 2>/dev/null | head -n 1)
-          
-          if [ -z "$METADATA_DIR" ]; then
-            echo "No metadata found"
-            exit 1
-          fi
-          
-          PR_NUMBER=$(cat "${METADATA_DIR}/pr-number.txt")
+          PR_NUMBER=$(cat "pr-number.txt")
           echo "number=${PR_NUMBER}" >> $GITHUB_OUTPUT
           echo "PR Number: ${PR_NUMBER}"
       

BUILDING.md

@@ -137,7 +137,7 @@ Attach debugger to the XPC helpers using their launchd service labels:
    % container system start
    % container run -d --name test debian:bookworm sleep infinity
    test
-   % launchd list | grep container
+   % launchctl list | grep container
    27068   0       com.apple.container.container-network-vmnet.default
    27072   0       com.apple.container.container-core-images
    26980   0       com.apple.container.apiserver

Package.resolved

@@ -23,7 +23,7 @@ import PackageDescription
 let releaseVersion = ProcessInfo.processInfo.environment["RELEASE_VERSION"] ?? "0.0.0"
 let gitCommit = ProcessInfo.processInfo.environment["GIT_COMMIT"] ?? "unspecified"
 let builderShimVersion = "0.8.0"
-let scVersion = "0.24.5"
+let scVersion = "0.25.0"
 
 let package = Package(
     name: "container",

Package.swift

@@ -26,11 +26,13 @@ struct BuildImageResolver: BuildPipelineHandler {
     let contentStore: ContentStore
     let quiet: Bool
     let output: FileHandle
+    let pull: Bool
 
-    public init(_ contentStore: ContentStore, quiet: Bool = false, output: FileHandle = FileHandle.standardError) throws {
+    public init(_ contentStore: ContentStore, quiet: Bool = false, output: FileHandle = FileHandle.standardError, pull: Bool = false) throws {
         self.contentStore = contentStore
         self.quiet = quiet
         self.output = output
+        self.pull = pull
     }
 
     func accept(_ packet: ServerStream) throws -> Bool {
@@ -72,6 +74,9 @@ struct BuildImageResolver: BuildPipelineHandler {
             defer { progress.finish() }
             progress.start()
 
+            if self.pull {
+                return try await ClientImage.pull(reference: ref, platform: platform, progressUpdate: progress.handler)
+            }
             // Use fetch() which checks cache first, then pulls if needed
             return try await ClientImage.fetch(reference: ref, platform: platform, progressUpdate: progress.handler)
         }()

Sources/ContainerBuild/BuildImageResolver.swift

@@ -30,7 +30,7 @@ public actor BuildPipeline {
             [
                 try BuildFSSync(URL(filePath: config.contextDir)),
                 try BuildRemoteContentProxy(config.contentStore),
-                try BuildImageResolver(config.contentStore, quiet: config.quiet, output: config.terminal?.handle ?? FileHandle.standardError),
+                try BuildImageResolver(config.contentStore, quiet: config.quiet, output: config.terminal?.handle ?? FileHandle.standardError, pull: config.pull),
                 try BuildStdio(quiet: config.quiet, output: config.terminal?.handle ?? FileHandle.standardError),
             ]
     }

Sources/ContainerBuild/BuildPipelineHandler.swift

@@ -251,6 +251,7 @@ public struct Builder: Sendable {
         public let exports: [BuildExport]
         public let cacheIn: [String]
         public let cacheOut: [String]
+        public let pull: Bool
 
         public init(
             buildID: String,
@@ -268,6 +269,7 @@ public struct Builder: Sendable {
             exports: [BuildExport],
             cacheIn: [String],
             cacheOut: [String],
+            pull: Bool
         ) {
             self.buildID = buildID
             self.contentStore = contentStore
@@ -284,6 +286,7 @@ public struct Builder: Sendable {
             self.exports = exports
             self.cacheIn = cacheIn
             self.cacheOut = cacheOut
+            self.pull = pull
         }
     }
 }

Sources/ContainerBuild/Builder.swift

@@ -131,6 +131,9 @@ extension Application {
         @Argument(help: "Build directory")
         var contextDir: String = "."
 
+        @Flag(name: .long, help: "Pull latest image")
+        var pull: Bool = false
+
         public func run() async throws {
             do {
                 let timeout: Duration = .seconds(300)
@@ -153,10 +156,10 @@ extension Application {
                     }
 
                     group.addTask { [vsockPort, cpus, memory, log, dnsNameservers] in
+                        let client = ContainerClient()
                         while true {
                             do {
-                                let container = try await ClientContainer.get(id: "buildkit")
-                                let fh = try await container.dial(vsockPort)
+                                let fh = try await client.dial(id: "buildkit", port: vsockPort)
 
                                 let threadGroup: MultiThreadedEventLoopGroup = MultiThreadedEventLoopGroup(numberOfThreads: System.coreCount)
                                 let b = try Builder(socket: fh, group: threadGroup)
@@ -313,7 +316,7 @@ extension Application {
                         }
                         return results
                     }()
-                    group.addTask { [terminal, buildArg, contextDir, label, noCache, target, quiet, cacheIn, cacheOut] in
+                    group.addTask { [terminal, buildArg, contextDir, label, noCache, target, quiet, cacheIn, cacheOut, pull] in
                         let config = Builder.BuildConfig(
                             buildID: buildID,
                             contentStore: RemoteContentStoreClient(),
@@ -329,7 +332,8 @@ extension Application {
                             quiet: quiet,
                             exports: exports,
                             cacheIn: cacheIn,
-                            cacheOut: cacheOut
+                            cacheOut: cacheOut,
+                            pull: pull
                         )
                         progress.finish()
 

Sources/ContainerCommands/BuildCommand.swift

@@ -39,14 +39,15 @@ extension Application {
 
         public func run() async throws {
             do {
-                let container = try await ClientContainer.get(id: "buildkit")
+                let client = ContainerClient()
+                let container = try await client.get(id: "buildkit")
                 if container.status != .stopped {
                     guard force else {
                         throw ContainerizationError(.invalidState, message: "BuildKit container is not stopped, use --force to override")
                     }
-                    try await container.stop()
+                    try await client.stop(id: container.id)
                 }
-                try await container.delete()
+                try await client.delete(id: container.id)
             } catch {
                 if error is ContainerizationError {
                     if (error as? ContainerizationError)?.code == .notFound {