Vendor Cargo dependencies #267
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
arc9693
added
the
upstream/not-needed
arc9693
force-pushed
the
archana1/vendor-crates
branch
2 times, most recently
from
cf07fbc to
cc7ce2f
Compare
sprt
reviewed
Dec 10, 2024
arc9693
force-pushed
the
archana1/vendor-crates
branch
from
cc7ce2f to
8e2cea3
Compare
sprt
reviewed
Dec 11, 2024
Redent0r
approved these changes
Dec 16, 2024
|
Thoughts on splitting this into separate PRs per target folder? it might still be a lot of file changes but we may be able to load them through github UI (up to 3000 file changes) |
Target rust folders: src/tardev-snapshotter, src/agent, src/utarfs, src/overlay The change involves vendoring Cargo dependencies to enhance build reproducibility and security. All dependencies are downloaded and stored locally in a vendor directory, eliminating the need to fetch them from external sources during builds. The projeci's Cargo configuration is updated to prioritize these vendored sources, ensuring consistent, self-contained builds regardless of external factors like network availability or changes in dependency repositories. By committing the vendor directory to version control, the project gains improved security, faster build times, and determinism. Developers must refresh the vendored dependencies whenever updates are made to the Cargo.toml, by re-running cargo vendor. Signed-off-by: Archana Choudhary <[email protected]>
arc9693
force-pushed
the
archana1/vendor-crates
branch
from
8e2cea3 to
7fa67f9
Compare
|
|
sprt
approved these changes
Dec 19, 2024
There was a problem hiding this comment.
Reviewed this by checking it out locally and LGTM.
But let's hold off on merging for now as @danmihai1 suggested an alternative approach that we might want to evaluate: don't vendor everything from the get go, but instead, for each package that needs to be patched, incrementally add it to the vendors.
ms-mahuber
approved these changes
Dec 28, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Target rust folders: src/tardev-snapshotter, src/agent, src/utarfs, src/overlay
The change involves vendoring Cargo dependencies to enhance build reproducibility and security. All dependencies are downloaded and stored locally in a vendor directory, eliminating the need to fetch them from external sources during builds. The projeci's Cargo configuration is updated to prioritize these vendored sources, ensuring consistent, self-contained builds regardless of external factors like network availability or changes in dependency repositories. By committing the vendor directory to version control, the project gains improved security, faster build times, and determinism. Developers must refresh the vendored dependencies whenever updates are made to the Cargo.toml, by re-running cargo vendor.
Merge Checklist
upstream/missinglabel (orupstream/not-needed) has been set on the PR.Summary
Test Methodology
Spec file changes (draft): microsoft/azurelinux@mahuber/kata-3.2.0.azl4...archana1/remove-rust-deps
Buddy Build of kata-containers and kata-containers-cc: https://dev.azure.com/mariner-org/mariner/_build?definitionId=2190&_a=summary (https://dev.azure.com/mariner-org/mariner/_build/results?buildId=693264&view=results)