Repository navigation
Do not stage APKINDEX files into the apko_image cache - #412
Open
alexander-scott wants to merge 1 commit into
Open
alexander-scott wants to merge 1 commit into
alexander-scott wants to merge 1 commit into
Conversation
apk_repository fetches the live, unpinned APKINDEX.tar.gz for every repository in the lockfile, and is deliberately not marked reproducible because the bytes depend on when it ran. apko_image then copied those indexes into the cache tree artifact that the apko build action consumes, so the action keys for both the cache staging step and `apko build` were a function of fetch time. Two machines that fetched the index even minutes apart could never share a remote cache entry for the image, and Wolfi rewrites its index several times an hour. `apko build --lockfile` never reads the index: it installs exactly the packages listed in the lockfile by URL and checksum (installablePackagesForArch -> InstallPackages) and only ResolveWorld, which is unreachable when a lockfile is given, loads repository indexes. Building with and without the indexes in the offline cache produces byte-identical OCI manifests on both amd64 and arm64. Stop staging the indexes. The `indexes` output group of apk_filegroup is left in place for any other consumers; with nothing depending on it the apk_repository repos are no longer fetched for image builds either. Signed-off-by: Alex Scott <alexanderscott@outlook.com>
alexander-scott
marked this pull request as ready for review
October 28, 2026 04:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
apk_repositoryfetches the live, unpinnedAPKINDEX.tar.gzfor every repository in the lockfile, and is deliberately not marked reproducible because the bytes depend on when it ran.apko_imagethen copied those indexes into the cache tree artifact that the apko build action consumes, so the action keys for both the cache staging step andapko buildwere a function of fetch time. Two machines that fetched the index even minutes apart could never share a remote cache entry for the image, and Wolfi rewrites its index several times an hour.apko build --lockfilenever reads the index: it installs exactly the packages listed in the lockfile by URL and checksum (installablePackagesForArch->InstallPackages) and onlyResolveWorld, which is unreachable when a lockfile is given, loads repository indexes. Building with and without the indexes in the offline cache produces byte-identical OCI manifests on both amd64 and arm64.Stop staging the indexes. The
indexesoutput group ofapk_filegroupis left in place for any other consumers; with nothing depending on it theapk_repositoryrepos are no longer fetched for image builds either.