[skywalking-eyes] Time for a new release?

[dronenb]

Hello all,

I have been investigating an issue with running skywalking-eyes/license-eye via Podman on Apple Silicon, and it seems as though a new release would resolve the issue I'm seeing, as well as resolving some security issues.

Ref:

• make license.check crashes external-secrets/external-secrets#6854
• fix: bump Makefile license-eye image to 0.9.0 external-secrets/external-secrets#6855

It appears that the most recent (0.8.0) tagged image for linux/arm64 contains an x86-64 binary. The recent, untagged images available via ghcr are fixed, but a new release has not been cut since that fix has been made.

For docker.io/apache/skywalking-eyes:0.8.0

crane export --platform linux/arm64 docker.io/apache/skywalking-eyes:0.8.0 - | tar -xO bin/license-eye | file -

Output (wrong, notice the x86-64):

/dev/stdin: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, Go BuildID=0ppNUtlH6DijiNxkim2d/nzqb9t2ZxrNaetmkZMFW/GI8Q7OLKKkFJsEju2XKZ/231RnScIBFzViuhC7Q3b, with debug_info, not stripped

For ghcr.io/apache/skywalking-eyes/license-eye:latest

crane export --platform linux/arm64 ghcr.io/apache/skywalking-eyes/license-eye:latest - | tar -xO bin/license-eye | file -

Output (correct, notice arm aarch64)

/dev/stdin: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, BuildID[sha1]=33365a429979f056c2cf0a3424e2563beaa5db6d, with debug_info, not stripped

In general, projects (understandably) wish to pin their tooling to a particular version to ensure reproducibility. Is it possible to cut a new release of license-eye so this can be fixed?

[wu-sheng]

Most users are only relying on the pinned commit ID. So, usually, we don't release much. Is this working for you?

[kezhenxu94]

I can cut a new release soon, but just to clarify, going through a release process doesn’t add anything more than using the commit sha, we have tests and they run in every PR/commit to make sure the features are not broken, cutting a new release only take some steps that ordinary users don’t care about at all

[evrardj-roche]

Oh it's just on our side: Currently bumping the version of skywalking-eyes is done by humans. So SHA won't get easily bumped, while tags are a tad easier/more natural.
If we pin a sha in our repo, I am afraid it would stay forever at the same place. Hence why I am asking to consider a release (even though it is extra work, sorry for that!).

I have plans to automate some of those and consume shas/digests and their changelog. We are not there yet.

[kezhenxu94]

Just FYI, I’ve just cut v0.9.0 https://github.com/apache/skywalking-eyes/releases/tag/v0.9.0 and am going through the release process

[evrardj-roche]

Awesome @kezhenxu94 , thanks a lot!!!!

[dronenb]

Thank you @kezhenxu94! I will close this discussion since a new tag has been published!