Merge branch 'security-review' into fix/untrusted-flow

.github/workflows/build.yml

@@ -23,7 +23,8 @@ jobs:
  config: [macos, linux, windows-lcow, windows-wcow]
  include:
  - config: macos
- os: macos
+ # since macos-14 the latest runner is arm64
+ os: macos-arm64
  runner: macos-latest
  no_docker: "true"
  pack_bin: pack
@@ -170,8 +171,9 @@ jobs:
  - name: linux-arm64
  goarch: arm64
  goos: linux
- - name: macos-arm64
- goarch: arm64
+ - name: macos
+ # since macos-14 default runner is arm, we need to build for intel architecture later
+ goarch: amd64
  goos: darwin
  - name: linux-s390x
  goarch: s390x

.github/workflows/delivery-archlinux.yml

@@ -11,64 +11,6 @@ on:
  required: true
 
 jobs:
- pack-cli:
- runs-on: ubuntu-latest
- env:
- PACKAGE_NAME: pack-cli
- steps:
- - uses: actions/checkout@v4
- - name: Determine version
- uses: actions/github-script@v7
- id: version
- with:
- result-encoding: string
- script: |
- let payload = context.payload;
- let tag = (payload.release && payload.release.tag_name) || (payload.inputs && payload.inputs.tag_name);
- if (!tag) {
- throw "ERROR: unable to determine tag"
- }
- return tag.replace(/^v/, '');
- - name: Set PACK_VERSION
- run: echo "PACK_VERSION=${{ steps.version.outputs.result }}" >> $GITHUB_ENV
- shell: bash
- - name: Setup working dir
- run: |
- mkdir -p ${{ env.PACKAGE_NAME }}
- cp .github/workflows/delivery/archlinux/${{ env.PACKAGE_NAME }}/PKGBUILD ${{ env.PACKAGE_NAME }}/PKGBUILD
- - name: Metadata
- id: metadata
- run: |
- url=https://github.com/buildpacks/pack/archive/v${{ env.PACK_VERSION }}.tar.gz
- filename=pack-${{ env.PACK_VERSION }}.tgz
- fullpath=`pwd`/$filename
-
- curl -sSL "$url" -o "$fullpath"
- sha512=$(sha512sum "$fullpath" | awk '{ print $1 }')
- echo "url=$url" >> $GITHUB_OUTPUT
- echo "sha512=$sha512" >> $GITHUB_OUTPUT
- - name: Fill PKGBUILD
- uses: cschleiden/replace-tokens@v1
- with:
- files: ${{ env.PACKAGE_NAME }}/PKGBUILD
- tokenPrefix: '{{'
- tokenSuffix: '}}'
- env:
- PACK_VERSION: ${{ env.PACK_VERSION }}
- SRC_TGZ_URL: ${{ steps.metadata.outputs.url }}
- SRC_TGZ_SHA: ${{ steps.metadata.outputs.sha512 }}
- - name: Print PKGBUILD
- run: cat ${{ env.PACKAGE_NAME }}/PKGBUILD
- - name: Test
- uses: docker://archlinux:latest
- with:
- entrypoint: .github/workflows/delivery/archlinux/test-install-package.sh
- - name: Publish
- uses: docker://archlinux:latest
- env:
- AUR_KEY: ${{ secrets.AUR_KEY }}
- with:
- entrypoint: .github/workflows/delivery/archlinux/publish-package.sh
  pack-cli-bin:
  runs-on: ubuntu-latest
  env:

.github/workflows/delivery-ubuntu.yml

@@ -20,7 +20,7 @@ jobs:
  strategy:
  fail-fast: false
  matrix:
- target: [bionic, focal, jammy, lunar, noble]
+ target: [bionic, focal, jammy, noble]
  runs-on: ubuntu-20.04
  steps:
  - name: Checkout code
@@ -103,18 +103,6 @@ jobs:
  GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
  PACKAGE_VERSION: ${{ steps.version.outputs.result }}
 
- - name: Deliver lunar
- if: matrix.target == 'lunar'
- uses: docker://ubuntu:lunar
- with:
- entrypoint: .github/workflows/delivery/ubuntu/deliver.sh
- env:
- DEBIAN_FRONTEND: "noninteractive"
- GO_DEP_PACKAGE_NAME: golang
- GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
- GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
- PACKAGE_VERSION: ${{ steps.version.outputs.result }}
-
  - name: Deliver noble
  if: matrix.target == 'noble'
  uses: docker://ubuntu:noble

.github/workflows/delivery/archlinux/README.md

@@ -1,8 +1,8 @@
 # Arch Linux
 
-There are 3 maintained packages:
+There are two maintained packages by us and one official archlinux package:
 
-- [pack-cli](https://aur.archlinux.org/packages/pack-cli/): The latest release of `pack`, compiled from source.
+- [pack-cli](https://archlinux.org/packages/extra/x86_64/pack-cli/): Official Archlinux package in the 'Extra' repo.
 - [pack-cli-bin](https://aur.archlinux.org/packages/pack-cli-bin/): The latest release of `pack`, precompiled.
 - [pack-cli-git](https://aur.archlinux.org/packages/pack-cli-git/): An unreleased version of `pack`, compiled from source of the `main` branch.
 

Dockerfile

@@ -1,6 +1,6 @@
 ARG base_image=gcr.io/distroless/static
 
-FROM golang:1.20 as builder
+FROM golang:1.22 as builder
 ARG pack_version
 ENV PACK_VERSION=$pack_version
 WORKDIR /app