Publish more java images

[loosebazooka]

• new java 17 images
• java on debian 11 in now multi arch (amd64, arm64)
• multiarch manifests are signed by cosign for (base, 17, 11)
• new naming
  • new tagging strategy is java(variant)-debian(version):... or
    java(-base,11,17)-debian(10,11):(latest,nonroot,debug,debug-nonroot)
    this provides some standardization around the tagging
  • old tags exists for now, but will be removed after notifying users

Signed-off-by: Appu Goundan appu@google.com

[loosebazooka]

This will eventually conclude with us no longer updating images with names

distroless/java:*
distroless/java-debian10:*
distroless/java-debian11:*

as versions will now be baked into the java* part

[timja]

Did cloudbuild fail? I can't see Java 17 in https://console.cloud.google.com/gcr/images/distroless/GLOBAL/java

and Java 11 was last updated 2 days ago.

[loosebazooka]

Yeah I messed up the manifest list creation, should be fixed once the PR goes in. Other than that -- this PR uses a new format for java17 images.

The images you are looking for are in: (with the multi-arch manifests coming in after #903 )
https://console.cloud.google.com/gcr/images/distroless/GLOBAL/java17
https://console.cloud.google.com/gcr/images/distroless/GLOBAL/java17-debian11

[DamianFekete]

This will eventually conclude with us no longer updating images with names

@loosebazooka, the java JDK images (java:11*, java:latest, ...) are already no longer updated with this change. Only the java:base images were marked as legacy and are still being updated (and they are kind of useless without the JDK):

https://github.com/GoogleContainerTools/distroless/pull/902/files#diff-3053677e4333a96b20ed76c662bca07fb2e1ce059479170139209356787da09cL160-L167

[loosebazooka]

Ah yeah maybe I missed those. Are the java11:latest and java11-debian11:latest not sufficient for your use though?

[DamianFekete]

@loosebazooka, they are sufficient, but it was by coincidence that I've noticed that java:nonroot is not updated anymore.

And I think many won't notice in the next months if the image is still there but doesn't get updated. I was wondering what the best way to deprecate those image is: maintain them for a year and after that delete them completely so that the build pipelines fail?

The readme doesn't explicitly mention the deprecation. java11-debian11 is mentioned, but even java11 isn't mentioned, so it is easy to pick or stick with the wrong image.

[loosebazooka]

Yeah sorry, the plan was to start deprecating these after a sufficient amount of time has passed - with notices going out. #921 should bring those tags back.