noop comments to force rebuilding of packages and get sboms

[deitch]

These changes are all a noop; they just add a simple comment to the pkg Dockerfile.

This does, however, change the git tree hash for those packages. With #3592 merged in, linuxkit will add an SBoM to those container images (via buildkit), which will be consumed in future PRs.

I went through images/rootfs.yml.in and found all of the images referenced there; those are the ones I updated. These are:

• acrn
• apparmor
• debug
• edgeview
• guacd
• kdump
• measure-config
• newlogd
• pillar
• rngd
• storage-init
• vtpm
• watchdog
• wlan
• wwan
• xen-tools

[rucoder]

I think it is worth adding license/ copyright header for all files while we are here

# Copyright (c) 2023 Zededa, Inc.
# SPDX-License-Identifier: Apache-2.0

[deitch]

Sure, that is even cleaner.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (8ea9bae) 19.43% compared to head (b1004e5) 19.43%.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3595   +/-   ##
=======================================
  Coverage   19.43%   19.43%           
=======================================
  Files         232      232           
  Lines       50533    50533           
=======================================
  Hits         9819     9819           
  Misses      39994    39994           
  Partials      720      720           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[deitch]

Why did the eden tests fail?

[deitch]

I don't understand why these are not building? It is complaining about the image not being in the cache, but it builds it locally.

[rucoder]

I don't understand why these are not building? It is complaining about the image not being in the cache, but it builds it locally.

did you rebase on top of latest master? there was a fix for eden yesterday

[deitch]

Possible I am out of date. I will do so now.

[deitch]

I tried a rebase, nothing changed. I did update the comments you suggested. Let it run again.

[rucoder]

LGTM

[eriknordmark]

LGTM

[deitch]

I converted this to draft. I found a bug in the linuxkit pkg build which successfully adds the sbom, but loses it when pushing out to the registry. Oops. A fix already is in the works, but let's hold on this until that is in place.

[deitch]

Bug in linuxkit fixed, update is in #3604; when that is in, I will rebase and push this, then convert it from draft to ready.

[deitch]

This is now ready for review.

[eriknordmark]

LGTM

[deitch]

So it did rebuild, but the pushed-out packages are missing the sboms. I do not yet know why, but I will investigate.

[deitch]

It looks like this is an issue in buildkit running in GHA, but I cannot be sure. Still working on it.

[deitch]

It gets stranger. I just uploaded the lkt cache as an artifact, so I could download it and see it. The manifest has the sboms. Which makes me wonder, perhaps it is working at build, but not at push?

[deitch]

OK, I have it. Bug in linuxkit, a path that I didn't realize we used and wasn't properly checked. Expect a PR soon enough.