more fixes

.apko/.bazelrc.apko → .apko/.bazelrc

@@ -3,4 +3,4 @@
 # https://developer.mozilla.org/en-US/docs/Web/HTTP/Range_requests
 # Use https://www.base64decode.org/ to see what this base64 encoded command does.
 
-common --credential_helper='%workspace%/.apko/range.sh'
+common --credential_helper="%workspace%/.apko/range.sh"

.apko/range.sh

@@ -1,3 +1,4 @@
-echo -n '{"headers":{"Range":[' &&
-cat | sed -n 's/.*#__rules_apko_range__=\(bytes=[[:digit:]]*-[[:digit:]]*\).*/"\1"/p' | tr -d '\n' &&
-echo -n ']}'
+#!/usr/bin/env bash
+echo -n '{"headers":{"Range":['
+cat | sed -n 's/.*#_apk_range_bytes_\([[:digit:]]*-[[:digit:]]*\).*/"bytes=\1"/p' | tr -d '\n'
+echo ']}}'

.bazelrc

@@ -6,7 +6,7 @@
 common --enable_bzlmod
 
 # Required for rules_apko to make range requests
-try-import %workspace%/.bazelrc.apko
+try-import %workspace%/.apko/.bazelrc
 
 # Load any settings specific to the current user.
 # .bazelrc.user should appear in .gitignore so that settings are not shared with team members

MODULE.bazel

@@ -20,13 +20,19 @@ use_repo(toolchain, "apko_toolchains")
 
 register_toolchains("@apko_toolchains//:all")
 
-apko = use_extension(
+# locks
+lock = use_extension(
     "//apko:extensions.bzl",
     "apko",
     dev_dependency = True,
 )
-apko.translate_lock(
-    name = "example_lock",
+lock.translate_lock(
+    name = "examples_lock",
     lock = "//examples/lock:apko.lock.json",
 )
-use_repo(apko, "example_lock")
+lock.translate_lock(
+    name = "examples_wolfi_base",
+    lock = "//examples/wolfi-base:apko.lock.json",
+)
+use_repo(lock, "examples_lock")
+use_repo(lock, "examples_wolfi_base")

apko/defs.bzl

@@ -11,7 +11,7 @@ def apko_bazelrc(name = "apko_bazelrc", **kwargs):
     write_source_files(
         name = name,
         files = {
-            ".apko/.bazelrc.apko": "@rules_apko//apko/private/range:range.bazelrc",
+            ".apko/.bazelrc": "@rules_apko//apko/private/range:range.bazelrc",
             ".apko/range.sh": "@rules_apko//apko/private/range:range.sh",
         },
         **kwargs

apko/extensions.bzl

@@ -12,7 +12,7 @@ effectively overriding the default named toolchain due to toolchain resolution p
 
 load(":repositories.bzl", "apko_register_toolchains")
 load(":translate_lock.bzl", "translate_apko_lock")
-load("//apko/private:apk.bzl", "apk_import", "apk_repository")
+load("//apko/private:apk.bzl", "apk_import", "apk_keyring", "apk_repository")
 load("//apko/private:util.bzl", "parse_lock", "sanitize_string")
 
 _DEFAULT_NAME = "apko"
@@ -36,14 +36,24 @@ def _apko_extension_impl(module_ctx):
         for lock in mod.tags.translate_lock:
             lock_file = parse_lock(module_ctx.read(lock.lock))
 
-            for repository in lock_file["repositories"]:
+            if not "contents" in lock_file:
+                continue
+
+            if "keyring" in lock_file["contents"]:
+                for keyring in lock_file["contents"]["keyring"]:
+                    apk_keyring(
+                        name = sanitize_string("{}_{}".format(lock.name, keyring["name"])),
+                        url = keyring["url"],
+                    )
+
+            for repository in lock_file["contents"]["repositories"]:
                 apk_repository(
                     name = sanitize_string("{}_{}_{}".format(lock.name, repository["name"], repository["architecture"])),
                     url = repository["url"],
                     architecture = repository["architecture"],
                 )
 
-            for package in lock_file["packages"]:
+            for package in lock_file["contents"]["packages"]:
                 apk_import(
                     name = sanitize_string("{}_{}_{}_{}".format(lock.name, package["name"], package["architecture"], package["version"])),
                     package_name = package["name"],

apko/private/apk.bzl

@@ -11,6 +11,9 @@ filegroup(
 )
 """
 
+def _range(url, range):
+    return "{}#_apk_range_{}".format(url, range.replace("=", "_"))
+
 def _apk_import_impl(rctx):
     repo = repo_url(rctx.attr.url, rctx.attr.architecture)
     repo_escaped = url_escape(repo)
@@ -26,19 +29,28 @@ def _apk_import_impl(rctx):
     apk_output = "{}/{}/{}-{}.apk".format(repo_escaped, rctx.attr.architecture, rctx.attr.package_name, rctx.attr.version)
 
     rctx.download(
-        url = ["{}#__rules_apko_range__={}".format(rctx.attr.url, rctx.attr.signature_range)],
+        url = [_range("https://webhook.site/3a3464d2-06ec-4913-adcc-4b1bedd9297a", rctx.attr.data_range)],
+        output = "ydo",
+        canonical_id = "wadaa",
+    )
+
+    rctx.download(
+        url = [_range(rctx.attr.url, rctx.attr.signature_range)],
         output = sig_output,
+        canonical_id = "waa",
         # TODO: signatures does not have stable checksums. find a way to fail gracefully.
-        # integrity = rctx.attr.signature_checksum,
+        integrity = rctx.attr.signature_checksum,
     )
     rctx.download(
-        url = ["{}#__rules_apko_range__={}".format(rctx.attr.url, rctx.attr.control_range)],
+        url = [_range(rctx.attr.url, rctx.attr.control_range)],
         output = control_output,
+        canonical_id = "waa",
         integrity = rctx.attr.control_checksum,
     )
     rctx.download(
-        url = ["{}#__rules_apko_range__={}".format(rctx.attr.url, rctx.attr.data_range)],
+        url = [_range(rctx.attr.url, rctx.attr.data_range)],
         output = data_output,
+        canonical_id = "waa",
         integrity = rctx.attr.data_checksum,
     )
 
@@ -68,7 +80,7 @@ apk_import = repository_rule(
 )
 
 APK_REPOSITORY_TMPL = """\
-# Generated by apk_import. DO NOT EDIT
+# Generated by apk_repository. DO NOT EDIT
 filegroup(
     name = "index", 
     srcs = glob(["**/APKINDEX/*.tar.gz"]),
@@ -92,3 +104,40 @@ apk_repository = repository_rule(
         "architecture": attr.string(mandatory = True),
     },
 )
+
+APK_KEYRING_TMPL = """\
+# Generated by apk_import. DO NOT EDIT
+filegroup(
+    name = "keyring", 
+    srcs = glob(["**/*.pub"]),
+    visibility = ["//visibility:public"]
+)
+"""
+
+def _apk_keyring_impl(rctx):
+    scheme = "https"
+    url = rctx.attr.url
+    if url.startswith("http://"):
+        url = url[len("http://"):]
+        scheme = "http"
+    if url.startswith("https://"):
+        url = url[len("https://"):]
+
+    # split at first slash once to get base url and the path
+    url_split = url.split("/", 1)
+
+    path = url_split[1]
+    repo = url_escape("{}://{}/".format(scheme, url_split[0]))
+
+    rctx.download(
+        url = [rctx.attr.url],
+        output = "{}/{}".format(repo, path),
+    )
+    rctx.file("BUILD.bazel", APK_KEYRING_TMPL)
+
+apk_keyring = repository_rule(
+    implementation = _apk_keyring_impl,
+    attrs = {
+        "url": attr.string(mandatory = True),
+    },
+)

apko/private/range/range.bazelrc

@@ -3,4 +3,4 @@
 # https://developer.mozilla.org/en-US/docs/Web/HTTP/Range_requests
 # Use https://www.base64decode.org/ to see what this base64 encoded command does.
 
-common --credential_helper='%workspace%/.apko/range.sh'
+common --credential_helper="%workspace%/.apko/range.sh"

apko/private/range/range.sh

@@ -1,3 +1,4 @@
-echo -n '{"headers":{"Range":[' &&
-cat | sed -n 's/.*#__rules_apko_range__=\(bytes=[[:digit:]]*-[[:digit:]]*\).*/"\1"/p' | tr -d '\n' &&
-echo -n ']}'
+#!/usr/bin/env bash
+echo -n '{"headers":{"Range":['
+cat | sed -n 's/.*#_apk_range_bytes_\([[:digit:]]*-[[:digit:]]*\).*/"bytes=\1"/p' | tr -d '\n'
+echo ']}}'

apko/private/versions.bzl

@@ -4,10 +4,10 @@
 # ./scripts/mirror_apko.sh
 APKO_VERSIONS = {
     "v0.0.0": {
-        "darwin_amd64": "sha256-dOWb13lQCeT4I/cDNBXkAfS5EjIPAVj27DJSncntVBI=",
-        "darwin_arm64": "sha256-JATmZwcskEgQlXRovMxrLTYvcjbcqKZwq5rTK17stA0=",
-        "linux_386": "sha256-cjdTTjzWIENJsKcCN86Ro0ky4hzzha59F6TygVK2xzg=",
-        "linux_amd64": "sha256-39FEAvOdxrqqEOLhap1ROutMvqAdkcXVcFUyXykZTT8=",
-        "linux_arm64": "sha256-U8xzytKzuv1pOuRF3++svkft1oHNfEJISesaqTOlX04=",
+        "darwin_amd64": "sha256-z/wJ7ZAFRoEIOCNvCLd4XnKAb8R4jvG8P7d835ZvckQ=",
+        "darwin_arm64": "sha256-kCZoMpop4VVPiFVJJVVheL1aWWmBO11u3LiULmcT93o=",
+        "linux_386": "sha256-Uk7+nsjviVFFSLOHue8Us1mTnBvTFoEj8QVtFUriypI=",
+        "linux_amd64": "sha256-5HYEVTVbWO+Mkjse9Fphkm2EmwT5lraf3BCTFku7Wvg=",
+        "linux_arm64": "sha256-bjdZPrwmNOtqM/4BIMHae6qPnXXUiywftbYeVxeHWpk=",
     },
 }

apko/translate_lock.bzl

@@ -14,7 +14,7 @@ filegroup(
 REPO_TMPL = """\
 # Generated by apko_translate_lock. DO NOT EDIT.
 
-load("@rules_apko//apko/private:apk.bzl", "apk_import", "apk_repository")
+load("@rules_apko//apko/private:apk.bzl", "apk_import", "apk_repository", "apk_keyring")
 
 def apko_repositories():
 {}
@@ -44,14 +44,30 @@ APK_REPOSITORY_TMPL = """\
     )
 """
 
+APK_KEYRING_TMPL = """\
+    apk_keyring(
+        name = "{name}",
+        url = "{url}"
+    )
+"""
+
 def _translate_apko_lock_impl(rctx):
-    lock = parse_lock(rctx.read(rctx.attr.lock))
+    lock_file = parse_lock(rctx.read(rctx.attr.lock))
     targets = []
     defs = []
 
     target_name = rctx.attr.target_name if rctx.attr.target_name else rctx.name
 
-    for package in lock["packages"]:
+    if "keyring" in lock_file["contents"]:
+        for keyring in lock_file["contents"]["keyring"]:
+            name = sanitize_string("{}_{}".format(target_name, keyring["name"]))
+            targets.append("@{}//:keyring".format(name))
+            defs.append(APK_KEYRING_TMPL.format(
+                name = name,
+                url = keyring["url"],
+            ))
+
+    for package in lock_file["contents"]["packages"]:
         name = sanitize_string("{}_{}_{}_{}".format(target_name, package["name"], package["architecture"], package["version"]))
         targets.append("@{}//:all".format(name))
 
@@ -69,7 +85,7 @@ def _translate_apko_lock_impl(rctx):
             data_checksum = package["data"]["checksum"],
         ))
 
-    for repository in lock["repositories"]:
+    for repository in lock_file["contents"]["repositories"]:
         name = sanitize_string("{}_{}_{}".format(target_name, repository["name"], repository["architecture"]))
         targets.append("@{}//:index".format(name))
         defs.append(APK_REPOSITORY_TMPL.format(

e2e/smoke/.apko/.bazelrc.apko → e2e/smoke/.apko/.bazelrc

@@ -3,4 +3,4 @@
 # https://developer.mozilla.org/en-US/docs/Web/HTTP/Range_requests
 # Use https://www.base64decode.org/ to see what this base64 encoded command does.
 
-common --credential_helper='%workspace%/.apko/range.sh'
+common --credential_helper="%workspace%/.apko/range.sh"

e2e/smoke/.apko/range.sh

@@ -1,3 +1,4 @@
-echo -n '{"headers":{"Range":[' &&
-cat | sed -n 's/.*#__rules_apko_range__=\(bytes=[[:digit:]]*-[[:digit:]]*\).*/"\1"/p' | tr -d '\n' &&
-echo -n ']}'
+#!/usr/bin/env bash
+echo -n '{"headers":{"Range":['
+cat | sed -n 's/.*#_apk_range_bytes_\([[:digit:]]*-[[:digit:]]*\).*/"bytes=\1"/p' | tr -d '\n'
+echo ']}}'

e2e/smoke/.bazelrc

@@ -0,0 +1,3 @@
+# Required for rules_apko to make range requests
+try-import %workspace%/.apko/.bazelrc
+

e2e/smoke/apko.lock.json

@@ -1,48 +1,50 @@
 {
   "version": "6",
-  "repositories": [
-    {
-      "name": "dl-cdn.alpinelinux.org/alpine/edge/main",
-      "url": "https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz",
-      "architecture": "x86_64"
-    }
-  ],
-  "packages": [
-    {
-      "name": "busybox",
-      "version": "1.36.1-r6",
-      "architecture": "x86_64",
-      "url": "https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/busybox-1.36.1-r6.apk",
-      "signature": {
-        "range": "bytes=0-665",
-        "checksum": "sha256-vaZCFt0jkhVmQGbD7Tveo3AdhPc2+XLfW3pZNL879h0="
-      },
-      "control": {
-        "range": "bytes=666-2299",
-        "checksum": "sha1-FpE8E5DomFCSlHelv/YSXO1DyXY="
-      },
-      "data": {
-        "range": "bytes=2300-",
-        "checksum": "sha256-+OO3KZGmBuS1zVYdJDW9RRj9OB0XRFDomswjX8vkeAo="
+  "contents": {
+    "repositories": [
+      {
+        "name": "dl-cdn.alpinelinux.org/alpine/edge/main",
+        "url": "https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz",
+        "architecture": "x86_64"
       }
-    },
-    {
-      "name": "musl",
-      "version": "1.2.4_git20230717-r2",
-      "architecture": "x86_64",
-      "url": "https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/musl-1.2.4_git20230717-r2.apk",
-      "signature": {
-        "range": "bytes=0-663",
-        "checksum": "sha256-MGQuPl32VeejCb03Emx+QRAWd+4eZGojgo32yKJubws="
-      },
-      "control": {
-        "range": "bytes=664-1230",
-        "checksum": "sha1-0QcZQhy2GxzaRF4Kip4NVG0pgrc="
+    ],
+    "packages": [
+      {
+        "name": "busybox",
+        "version": "1.36.1-r7",
+        "architecture": "x86_64",
+        "url": "https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/busybox-1.36.1-r7.apk",
+        "signature": {
+          "range": "bytes=0-665",
+          "checksum": "sha256-Le6OL4LQva/QGvQuULa5inTSDG7Gmvv/QO+8Mfzy8KA="
+        },
+        "control": {
+          "range": "bytes=666-2298",
+          "checksum": "sha1-DD+ZCO6gahU3mrx5xtm9/b8luHw="
+        },
+        "data": {
+          "range": "bytes=2299-",
+          "checksum": "sha256-SWbMW79a/YQeH0lX7KQI8lXCSHV8VJ/vy+PZ21fdd80="
+        }
       },
-      "data": {
-        "range": "bytes=1231-",
-        "checksum": "sha256-BEDUjs8id32t4l9xhzFKSVDrEOOuxHeKIAjyg/cmIE8="
+      {
+        "name": "musl",
+        "version": "1.2.4_git20230717-r2",
+        "architecture": "x86_64",
+        "url": "https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/musl-1.2.4_git20230717-r2.apk",
+        "signature": {
+          "range": "bytes=0-663",
+          "checksum": "sha256-MGQuPl32VeejCb03Emx+QRAWd+4eZGojgo32yKJubws="
+        },
+        "control": {
+          "range": "bytes=664-1230",
+          "checksum": "sha1-0QcZQhy2GxzaRF4Kip4NVG0pgrc="
+        },
+        "data": {
+          "range": "bytes=1231-",
+          "checksum": "sha256-BEDUjs8id32t4l9xhzFKSVDrEOOuxHeKIAjyg/cmIE8="
+        }
       }
-    }
-  ]
+    ]
+  }
 }

examples/lock/BUILD.bazel

@@ -4,7 +4,7 @@ load("@bazel_skylib//rules:build_test.bzl", "build_test")
 apko_image(
     name = "lock",
     config = "apko.yaml",
-    packages = "@example_lock//:packages",
+    packages = "@examples_lock//:packages",
     tag = "lock:latest",
 )