chore(docker): gpgv alone, no pip, botocore trimmed, gha build cache - #7
Merged
Merged
Conversation
rsync ships gpgv instead of the gnupg suite: the engine verifies and never signs. proton uninstalls pip once the pins are in and keeps only the s3 and sts botocore models, as rsync already does; the self-check proves both. ci and release build through buildx with the Actions cache, one scope per variant shared between them, so a tag rebuilds only the layers a merge touched instead of both platforms from scratch under QEMU. rsync 375 -> 370 MB, proton 492 -> 455 MB uncompressed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
gpgvreplacesgnupgin the shipped stage. The engine only ever verifies; the fetch stage keeps full gpg for the AWS CLI signature.pipis uninstalled once the pinned packages are in, and botocore keeps only thes3andstsmodels plus the data-root JSON, matching what rsync already does. The self-check asserts pip is gone and that a boto3 s3 client still constructs.type=ghacache, one scope per variant shared between the two workflows. A tag release now rebuilds only the layers the merge touched instead of both platforms from scratch under QEMU.Sizes, uncompressed: rsync 375 -> 370 MB, proton 492 -> 455 MB. The point of the gpgv and pip changes is surface, not size.
Test plan
task image-build && task run -- task tools && task check && task run -- task offlineinexamples/rsyncandexamples/proton, Apple container, arm64: all pass, render matches render.txt for bothv2.1.2; the release job should hit the cache populated by CI on mainAfter merge
Tag
v2.1.2. Mirrors onrsync-v2andproton-v2pick it up on their next run.