Merge pull request 'feat: add uv to fedora base images' (#7) from benvin/fedora-uv into main

Reviewed-on: #7

.woodpecker/build-matrix.yaml

@@ -0,0 +1,44 @@
+when:
+  - event: pull_request
+
+matrix:
+  include:
+    # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
+    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
+    - DISTRO: alma9
+      IMAGE: almalinux9
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
+    - DISTRO: fedora42
+      IMAGE: fedora42
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
+    - DISTRO: fedora43
+      IMAGE: fedora43
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
+    - DISTRO: fedora44
+      IMAGE: fedora44
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"
+
+steps:
+  - name: build
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
+    settings:
+      # registry is what gets the internal CA into the buildkit container: the plugin
+      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
+      # when it is set. The plugin has no buildkit_config setting.
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
+      target: image
+      dry_run: true
+      build_args:
+        BASE_IMAGE: "${BASE_IMAGE}"
+        DISTRO: "${DISTRO}"
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2

.woodpecker/build.yaml

@@ -1,35 +1,22 @@
+# Branch protection requires ci/woodpecker/pr/build; matrix entries report build-matrix/<n>.
 when:
   - event: pull_request
 
-matrix:
+depends_on:
-  include:
+  - build-matrix
-    # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
-    # BASE_IMAGE must match the distro's distro.env; ci/check-distros.sh enforces it.
-    - DISTRO: alma9
-      IMAGE: almalinux9
-      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
 
 steps:
   - name: build
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
-    settings:
+    commands:
-      # registry is what gets the internal CA into the buildkit container: the plugin
+      - echo "all build-matrix entries passed"
-      # writes a buildkit.toml pointing at /etc/docker/certs.d/<registry>/ca.crt only
-      # when it is set. The plugin has no buildkit_config setting.
-      registry: artifactapi.k8s.syd1.au.unkin.net
-      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/${IMAGE}"
-      target: image
-      dry_run: true
-      build_args:
-        BASE_IMAGE: "${BASE_IMAGE}"
-        DISTRO: "${DISTRO}"
     backend_options:
       kubernetes:
         serviceAccountName: default
         resources:
           requests:
-            memory: 1Gi
+            memory: 64Mi
-            cpu: 1
+            cpu: 100m
           limits:
-            memory: 4Gi
+            memory: 128Mi
-            cpu: 2
+            cpu: 250m

.woodpecker/docker.yaml

@@ -9,6 +9,15 @@ matrix:
     - DISTRO: alma9
       IMAGE: almalinux9
       BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
+    - DISTRO: fedora42
+      IMAGE: fedora42
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
+    - DISTRO: fedora43
+      IMAGE: fedora43
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
+    - DISTRO: fedora44
+      IMAGE: fedora44
+      BASE_IMAGE: "artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"
 
 steps:
   - name: docker

Dockerfile

@@ -5,7 +5,7 @@ ARG DISTRO=alma9
 COPY distros/${DISTRO}/ /tmp/distro/
 # DL3041: versions are pinned by the estate dnf repos, not here. SC2086: $PACKAGES is a
 # word list on purpose. DL4006: the only pipe ends in sha256sum, whose status is the
-# pipeline's, and set -e catches it.
+# pipeline's, and set -e catches it. zchunk is off because artifactapi ignores Range requests.
 # hadolint ignore=DL3041,DL4006,SC2086
 RUN set -eux; \
     . /tmp/distro/distro.env; \
@@ -14,6 +14,7 @@ RUN set -eux; \
     echo "$CA_RPM_SHA256  /tmp/ca.rpm" | sha256sum -c -; \
     rpm -i /tmp/ca.rpm; \
     cp /tmp/distro/yum.repos.d/*.repo /etc/yum.repos.d/; \
+    sed -i '/^\[main\]/a zchunk=False' /etc/dnf/dnf.conf; \
     dnf makecache; \
     dnf update -y; \
     dnf install -y $PACKAGES; \

README.md

@@ -7,6 +7,9 @@ built. Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<
 | distro | image | from |
 | --- | --- | --- |
 | `alma9` | `almalinux9` | `dockerhub/library/almalinux:9` |
+| `fedora42` | `fedora42` | `dockerhub/library/fedora:42` |
+| `fedora43` | `fedora43` | `dockerhub/library/fedora:43` |
+| `fedora44` | `fedora44` | `dockerhub/library/fedora:44` |
 
 Each image bootstraps the internal CA, installs the estate dnf repository
 configuration pointed at artifactapi, and installs the base package set.
@@ -15,7 +18,7 @@ configuration pointed at artifactapi, and installs the base package set.
 
 1. `distros/<name>/distro.env` — `BASE_IMAGE`, `IMAGE`, `CA_RPM_URL`, `CA_RPM_SHA256`, `PACKAGES`.
 2. `distros/<name>/yum.repos.d/*.repo` — repository configuration for that distro.
-3. One `include` entry in each of `.woodpecker/{build,docker}.yaml`.
+3. One `include` entry in each of `.woodpecker/{build-matrix,docker}.yaml`.
 
 The `check-distros` pre-commit hook fails if step 1 or 3 is incomplete.
 

ci/check-distros.sh

@@ -4,7 +4,7 @@
 set -uo pipefail
 
 KEYS="BASE_IMAGE IMAGE CA_RPM_URL CA_RPM_SHA256 ESTATE_REPO PACKAGES"
-WORKFLOWS=(.woodpecker/build.yaml .woodpecker/docker.yaml)
+WORKFLOWS=(.woodpecker/build-matrix.yaml .woodpecker/docker.yaml)
 
 fail=0
 for d in distros/*/; do

distros/fedora42/distro.env

@@ -0,0 +1,13 @@
+# fedora42 — Fedora 42
+# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env.
+BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:42"
+IMAGE="fedora42"
+
+# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f42 repodata pkgid.
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f42/Packages/unkin-ca-certificates-2026.10.2-1.fc42.x86_64.rpm"
+CA_RPM_SHA256="4c93bc95e0365565ee708247b9593997131d647d40a69e6f8bf9482f21026f9a"
+
+# Estate local repo used to prove HTTPS trust and dnf reachability.
+ESTATE_REPO="rpm-vendor-f42"
+
+PACKAGES="git jq make python3 python3-pip uv wget"

distros/fedora42/yum.repos.d/fedora.repo

@@ -0,0 +1,13 @@
+[fedora]
+name=Fedora 42 - x86_64
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora-archive/releases/42/Everything/x86_64/os
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-primary
+enabled=1
+gpgcheck=1
+
+[updates]
+name=Fedora 42 - x86_64 - Updates
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora-archive/updates/42/Everything/x86_64
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-42-primary
+enabled=1
+gpgcheck=1

distros/fedora42/yum.repos.d/unkin.repo

@@ -0,0 +1,27 @@
+[rpm-internal-f42]
+name=rpm-internal-f42 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f42/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor-f42]
+name=rpm-vendor-f42 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f42/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-internal]
+name=rpm-internal repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor]
+name=rpm-vendor repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
+enabled=1
+gpgcheck=0
+metadata_expire=60

distros/fedora43/distro.env

@@ -0,0 +1,13 @@
+# fedora43 — Fedora 43
+# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env.
+BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:43"
+IMAGE="fedora43"
+
+# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f43 repodata pkgid.
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f43/Packages/unkin-ca-certificates-2026.10.2-1.fc43.x86_64.rpm"
+CA_RPM_SHA256="5c80725659a0cd4228cf834dced0025ceac34f042a1715faff72a68363f61404"
+
+# Estate local repo used to prove HTTPS trust and dnf reachability.
+ESTATE_REPO="rpm-vendor-f43"
+
+PACKAGES="git jq make python3 python3-pip uv wget"

distros/fedora43/yum.repos.d/fedora.repo

@@ -0,0 +1,13 @@
+[fedora]
+name=Fedora 43 - x86_64
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/43/Everything/x86_64/os
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-primary
+enabled=1
+gpgcheck=1
+
+[updates]
+name=Fedora 43 - x86_64 - Updates
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/43/Everything/x86_64
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-primary
+enabled=1
+gpgcheck=1

distros/fedora43/yum.repos.d/unkin.repo

@@ -0,0 +1,27 @@
+[rpm-internal-f43]
+name=rpm-internal-f43 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f43/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor-f43]
+name=rpm-vendor-f43 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f43/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-internal]
+name=rpm-internal repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor]
+name=rpm-vendor repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
+enabled=1
+gpgcheck=0
+metadata_expire=60

distros/fedora44/distro.env

@@ -0,0 +1,13 @@
+# fedora44 — Fedora 44
+# Pulled through the artifactapi dockerhub remote; see distros/alma9/distro.env.
+BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44"
+IMAGE="fedora44"
+
+# Internal CA bootstrap over HTTP, verified against the rpm-vendor-f44 repodata pkgid.
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/Packages/unkin-ca-certificates-2026.10.2-1.fc44.x86_64.rpm"
+CA_RPM_SHA256="19929d13dd7a0542af3bf1dce736568b87159914b0261d7a9965edfd58dfc9cd"
+
+# Estate local repo used to prove HTTPS trust and dnf reachability.
+ESTATE_REPO="rpm-vendor-f44"
+
+PACKAGES="git jq make python3 python3-pip uv wget"

distros/fedora44/yum.repos.d/fedora.repo

@@ -0,0 +1,13 @@
+[fedora]
+name=Fedora 44 - x86_64
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/releases/44/Everything/x86_64/os
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary
+enabled=1
+gpgcheck=1
+
+[updates]
+name=Fedora 44 - x86_64 - Updates
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/fedora/updates/44/Everything/x86_64
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary
+enabled=1
+gpgcheck=1

distros/fedora44/yum.repos.d/unkin.repo

@@ -0,0 +1,27 @@
+[rpm-internal-f44]
+name=rpm-internal-f44 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-f44/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor-f44]
+name=rpm-vendor-f44 repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-internal]
+name=rpm-internal repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal/
+enabled=1
+gpgcheck=0
+metadata_expire=60
+
+[rpm-vendor]
+name=rpm-vendor repository
+baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
+enabled=1
+gpgcheck=0
+metadata_expire=60