VERSION: release v0.6.0

[cyphar]

umoci v0.6.0 -- "Please mind the gap between the train and the platform."

This is a fairly major update to umoci.

This update to umoci includes support for v1.1.1 of the OCI image
specification. For the most part, this mostly involves supporting
reading new features added to the specification (such as embedded-data
descriptors and subject references used by OCI artifact images), but at
the moment umoci does not yet support creating images utilising these
features.

In addition, umoci also now supports generating config.json blobs that
are compliant with v1.2.1 of the OCI runtime specification. Note that we
do not explicitly use any of the newer features, this is mostly a
quality-of-life update to move away from our ancient pinned version of
the runtime-spec.

Breaking:

* github.com/opencontainers/umoci/oci/config/generate.Generator has had
  the following breaking API changes made to it:
  - The existing ConfigExposedPorts and ConfigVolumes methods now return
    a sorted []string instead of a map.
  - The (Set)OS and (Set)Architecture methods have been renamed to have
    a Platform prefix (to match image-spec v1.1's organisational
    changes). They now read as (Set)PlatformOS and
    (Set)PlatformArchitecture respectively.

Added:

* umoci stat now includes information about the manifest and
  configuration of the image, both in the regular and JSON-formatted
  outputs.
* umoci now has [SOURCE_DATE_EPOCH][source-date-epoch] support, to
  attempt to make it easier to create reproducible images. Our behaviour
  is modelled after tar --clamp-mtime, meaning that SOURCE_DATE_EPOCH
  will only be used to modify the timestamps of files **newer** than
  SOURCE_DATE_EPOCH.

  As umoci repack works based on diffs, this also means that only files
  that were modified (and will thus be usually be included in the new
  layer) will have their timestamps rewritten.

  --history.created and umoci config --created will also now default to
  SOURCE_DATE_EPOCH (if set).

  With this change, umoci should be fairly compliant with reproducible
  builds. Please let us know if you find any other problematic areas in
  umoci (we are investigating some other possible causes of instability
  such as Go map iteration).
* In order to avoid the need for a patched gomtree package that supports
  rootless mode, umoci now has a umoci raw mtree-validate subcommand
  that implements the key gomtree validate features we need for our
  integration tests.

  Note that this subcommand is not intended for wider use outside of our
  tests (and it is hidden from the help pages for a reason). Most users
  are probably better off just using gomtree.
* umoci --version now provides more information about the specification
  versions supported by the umoci binary as well as the Go version used.
* umoci config now supports specifying the architecture variant of the
  image with --platform.variant. In addition, --os and --architecture
  can now be set using --platform.os and --platform.arch respectively.
* umoci new will not automatically fill the architecture variant on ARM
  systems to match the host CPU.

Changed:

* The output format of umoci stat has had some minor changes made to how
  special characters are escaped and when quoting is carried out.

Fixed:

* Some minor aspects of how umoci stat would filter special characters
  in history entries have been resolved.
* umoci repack will now truncate the mtime of files added to the layer
  tar archives. Previously, we would defer to the Go stdlib's
  archive/tar which rounds to the nearest second (which is incompatible
  with gomtree and so in theory could lead to inconsistent results).
* Previously, when generating the runtime-spec config.json, umoci unpack
  would incorrectly prioritise the automatically generated annotations
  over explicitly configured labels. This precdence was the opposite of
  what the image-spec requires, and has now been resolved.

Thanks to the following contributors for making this release possible:

 * Aleksa Sarai <cyphar@cyphar.com>
 * Danish Prakash <contact@danishpraka.sh>

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.94%. Comparing base (a058839) to head (35992ba).
⚠️ Report is 18 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #642      +/-   ##
==========================================
+ Coverage   72.89%   72.94%   +0.05%     
==========================================
  Files          71       71              
  Lines        6164     6181      +17     
==========================================
+ Hits         4493     4509      +16     
- Misses       1213     1214       +1     
  Partials      458      458              

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.