chore: add utilities for Windows Docker image publishing

[CaerusKaru]

Currently, Buildbarn repos publish the artifacts from
cross-compiled builds of the various ecosystem binaries. However,
this leaves the user to manage pulling those artifacts and
distributing/consuming them in their respective environments. For
customers leveraging Kubernetes or other containerized settings,
this creates a greater burden than Linux consumers.

In a previous commit, the image handling was moved to rules_img,
however rules_img does not allow for the necessary manifest
layering to include a Windows image (with a distinct base layer).
Therefore, we add an additional macro that reverts back to the
original rules_oci publish stream, until rules_img can be updated
to support that behavior. For images that do not benefit from a
Windows build-out (e.g. the non-RBE images), the new path can
still be safely utilized.

[aspect-workflows]

Test

All tests were cache hits

29 tests (100.0%) were fully cached saving 6s.

[EdSchouten]

In a previous commit, the image handling was moved to rules_img, however rules_img does not allow for the necessary manifest layering to include a Windows image (with a distinct base layer).

Can't we fix rules_img to support this?

[CaerusKaru]

Can't we fix rules_img to support this?

Of course we can, but I don't maintain that library, nor do I have the time to manage such a fix. What I do know is that rules_oci works for this case, and the way I've structured this commit, a) most images will continue to use it; and b) once it is patched, it would be trivial to move the images we do apply this to back to it.

[EdSchouten]

@malt3 Would you happen to have any input on this matter?

[malt3]

I believe we do support Windows, but there may be issues when combining separate base images on different platforms (where those do not use a common image index).
Happy to add support for this soon-ish, but I don't want to block any important features from being added to Buildbarn.

[EdSchouten]

Given that we never built container images for Windows before, this PR adds a new feature. As far as I know, it does not fix a regression. I am therefore tempted to not merge this in its current form, but ask @CaerusKaru and @malt3 to collaborate on building this on top of rules_img.

[CaerusKaru]

Will leave this PR here until the rules_img patch is ready, then pick it up again and add the new platforms.

[malt3]

I now added partial support for select on base images here: bazel-contrib/rules_img#390.

In short, we allow select on the base image as long as all of the omitted blobs during lazy pulling can be downloaded from a single upstream. In this case, we would need to set the layer_handling attribute for one or both of the base images to "eager" so that the PullInfo is only used for distroless or nanoserver (or neither).

I'll consider adding support for true merging of PullInfo in the future, but this requires larger code changes that will take more time.

[CaerusKaru]

@malt3 that's ok, the eager pull is acceptable here. Can you push a new version to BCR? Using git_override with the latest SHA results in toolchain errors.

[malt3]

On it! I'll comment here once this makes it into the bcr.

Edit: rules_img 0.3.4 is out and includes the PR.

[CaerusKaru]

@EdSchouten I think we're set then, as of latest commit

[EdSchouten]

Can you please run Buildifier to re-add the missing newline at the end of the file?

I guess you're using VSCode, right? It is known for generating malformed text files by default.

[CaerusKaru]

Can you please run Buildifier to re-add the missing newline at the end of the file?

I guess you're using VSCode, right? It is known for generating malformed text files by default.

Good catch; fixed.