refactor: use hermetic tar

Fixes #328

MODULE.bazel

@@ -6,7 +6,7 @@ module(
  compatibility_level = 1,
 )
 
-bazel_dep(name = "aspect_bazel_lib", version = "1.32.0")
+bazel_dep(name = "aspect_bazel_lib", version = "2.0.0-beta0")
 bazel_dep(name = "bazel_skylib", version = "1.4.1")
 bazel_dep(name = "platforms", version = "0.0.5")
 

oci/dependencies.bzl

@@ -29,7 +29,7 @@ def rules_oci_dependencies():
 
  http_archive(
  name = "aspect_bazel_lib",
- sha256 = "f1c181b910f821072f38ee45bb87db6b56275458c7f832c54c54ba6334119eca",
- strip_prefix = "bazel-lib-1.32.0",
- url = "https://github.com/aspect-build/bazel-lib/releases/download/v1.32.0/bazel-lib-v1.32.0.tar.gz",
+ sha256 = "39ecbb25198950bab1cddc0f36e271f95a3e8bdb102c70e5c3ca6beb48602799",
+ strip_prefix = "bazel-lib-2.0.0-beta0",
+ url = "https://github.com/aspect-build/bazel-lib/releases/download/v2.0.0-beta0/bazel-lib-v2.0.0-beta0.tar.gz",
  )

oci/private/tarball.bzl

@@ -49,11 +49,13 @@ def _tarball_impl(ctx):
  image = ctx.file.image
  tarball = ctx.actions.declare_file("{}/tarball.tar".format(ctx.label.name))
  yq_bin = ctx.toolchains["@aspect_bazel_lib//lib:yq_toolchain_type"].yqinfo.bin
+ bsdtar = ctx.toolchains["@aspect_bazel_lib//lib:tar_toolchain_type"]
  executable = ctx.actions.declare_file("{}/tarball.sh".format(ctx.label.name))
  repo_tags = ctx.file.repo_tags
 
  substitutions = {
  "{{yq}}": yq_bin.path,
+ "{{tar}}": bsdtar.tarinfo.binary.path,
  "{{image_dir}}": image.path,
  "{{tarball_path}}": tarball.path,
  }
@@ -70,7 +72,10 @@ def _tarball_impl(ctx):
 
  ctx.actions.run(
  executable = util.maybe_wrap_launcher_for_windows(ctx, executable),
- inputs = [image, repo_tags, executable],
+ inputs = depset(
+ direct = [image, repo_tags, executable],
+ transitive = [bsdtar.default.files],
+ ),
  outputs = [tarball],
  tools = [yq_bin],
  mnemonic = "OCITarball",
@@ -98,6 +103,7 @@ oci_tarball = rule(
  doc = doc,
  toolchains = [
  "@bazel_tools//tools/sh:toolchain_type",
+ "@aspect_bazel_lib//lib:tar_toolchain_type",
  "@aspect_bazel_lib//lib:yq_toolchain_type",
  ],
  executable = True,

oci/private/tarball.sh.tpl

@@ -3,6 +3,7 @@ set -o pipefail -o errexit -o nounset
 
 readonly STAGING_DIR=$(mktemp -d)
 readonly YQ="{{yq}}"
+readonly TAR="{{tar}}"
 readonly IMAGE_DIR="{{image_dir}}"
 readonly BLOBS_DIR="${STAGING_DIR}/blobs"
 readonly TARBALL_PATH="{{tarball_path}}"
@@ -34,5 +35,4 @@ layers="${LAYERS}" \
  --null-input '.[0] = {"Config": env(config), "RepoTags": "${repo_tags}" | envsubst | split("%") | map(select(. != "")) , "Layers": env(layers) | map( "blobs/" + . + ".tar.gz") }' \
  --output-format json > "${STAGING_DIR}/manifest.json"
 
-# TODO: https://github.com/bazel-contrib/rules_oci/issues/217
-tar -C "${STAGING_DIR}" -cf "${TARBALL_PATH}" manifest.json blobs
+${TAR} -C "${STAGING_DIR}" -cf "${TARBALL_PATH}" manifest.json blobs

oci/repositories.bzl

@@ -1,6 +1,6 @@
 """Repository rules for fetching external tools"""
 
-load("@aspect_bazel_lib//lib:repositories.bzl", "register_copy_to_directory_toolchains", "register_coreutils_toolchains", "register_jq_toolchains", "register_yq_toolchains")
+load("@aspect_bazel_lib//lib:repositories.bzl", "register_copy_to_directory_toolchains", "register_coreutils_toolchains", "register_jq_toolchains", "register_tar_toolchains", "register_yq_toolchains")
 load("//oci/private:auth_config_locator.bzl", "oci_auth_config_locator")
 load("//oci/private:toolchains_repo.bzl", "PLATFORMS", "toolchains_repo")
 load("//oci/private:versions.bzl", "CRANE_VERSIONS", "ZOT_VERSIONS")
@@ -115,6 +115,7 @@ def oci_register_toolchains(name, crane_version, zot_version = None, register =
 
  register_yq_toolchains(register = register)
  register_jq_toolchains(register = register)
+ register_tar_toolchains(register = register)
  register_coreutils_toolchains(register = register)
  register_copy_to_directory_toolchains(register = register)