Change testdata to be a bit smaller

This has two packages, pretend-baselayout and replayout.

Replayout replaces pretend-baselayout and has a dependency on it.

This also makes those artifacts reproducible via:

$ ./hack/update-packages.sh

My plan is to check in some actual images built from these packages, and
the tzdata package is just a little too big to be comfy doing that.

Also drop some things from .gitignore that are very annoying.

Signed-off-by: Jon Johnson <[email protected]>

.gitignore

@@ -20,9 +20,3 @@ bin/
 .idea
 tmp/
 _output
-
-# Development files
-apko.yaml
-output.tar
-sbom-*.cdx
-sbom-*.spdx.json

hack/update-packages.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+# Copyright 2023 Chainguard, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+set -ex
+
+(cd internal/cli/testdata && \
+  melange build --arch arm64 --arch amd64 -r https://packages.wolfi.dev/os -k https://packages.wolfi.dev/os/wolfi-signing.rsa.pub --signing-key ./melange.rsa pretend-baselayout.melange.yaml && \
+  melange build --arch arm64 --arch amd64 -r https://packages.wolfi.dev/os -k https://packages.wolfi.dev/os/wolfi-signing.rsa.pub --signing-key ./melange.rsa replayout.melange.yaml)
+(cd internal/cli &&
+  apko lock ./testdata/apko.yaml)

internal/cli/publish_test.go

@@ -57,7 +57,7 @@ func TestPublish(t *testing.T) {
 	st := &sentinel{s.Client().Transport}
 	dst := fmt.Sprintf("%s/test/publish", u.Host)
 
-	config := filepath.Join("testdata", "tzdata.yaml")
+	config := filepath.Join("testdata", "apko.yaml")
 
 	outputRefs := ""
 	archs := types.ParseArchitectures([]string{"amd64", "arm64"})
@@ -86,7 +86,7 @@ func TestPublish(t *testing.T) {
 
 	// This test will fail if we ever make a change in apko that changes the image.
 	// Sometimes, this is intentional, and we need to change this and bump the version.
-	want := "sha256:add006b981a4421349eb1a0cb50044d2d7589ed2b3cfbbe2e7c30f005f79438f"
+	want := "sha256:685a8f5d66554057ea6e697be713d81bdaec276f4ef845243e60fc61df698168"
 	require.Equal(t, want, digest.String())
 
 	sdst := fmt.Sprintf("%s:%s.sbom", dst, strings.ReplaceAll(want, ":", "-"))
@@ -104,7 +104,7 @@ func TestPublish(t *testing.T) {
 
 	// This test will fail if we ever make a change in apko that changes the SBOM.
 	// Sometimes, this is intentional, and we need to change this and bump the version.
-	swant := "sha256:2cbdb42a7b4160cdcd44836a583fa23985532e1641f026365f653006545ad90c"
+	swant := "sha256:89c0c452eab526bebac6d4e4ed8c14a3f9bfdf1e828438add5276a73fb657ae1"
 	require.Equal(t, swant, got)
 
 	im, err := idx.IndexManifest()
@@ -113,8 +113,8 @@ func TestPublish(t *testing.T) {
 	// We also want to check the children SBOMs because the index SBOM does not have
 	// references to the children SBOMs, just the children!
 	wantBoms := []string{
-		"sha256:a6acf3531effec2dd296834096fccff905d73f6838d9f680419c9bfbedad42f7",
-		"sha256:91097a5a791914cf2456e540671d47d369ae980c5376844ae978e56c15e8957c",
+		"sha256:bef40bcaa24ff513c1add5e0133a663519081ed5fd770a67609089ebb1b4a5a3",
+		"sha256:c400175e8fb4d7b3e2eb0442b7991716b3f6a770539f5e0f9d47e52a426e5431",
 	}
 
 	for i, m := range im.Manifests {

internal/cli/testdata/apko.lock.json

@@ -0,0 +1,101 @@
+{
+  "version": "v1",
+  "contents": {
+    "keyring": [
+      {
+        "name": "./testdata/melange.rsa.pub",
+        "url": "./testdata/melange.rsa.pub"
+      }
+    ],
+    "repositories": [
+      {
+        "name": "./testdata/packages/x86_64",
+        "url": "./testdata/packages/x86_64/APKINDEX.tar.gz",
+        "architecture": "x86_64"
+      },
+      {
+        "name": "./testdata/packages/aarch64",
+        "url": "./testdata/packages/aarch64/APKINDEX.tar.gz",
+        "architecture": "aarch64"
+      }
+    ],
+    "packages": [
+      {
+        "name": "pretend-baselayout",
+        "url": "./testdata/packages/x86_64/pretend-baselayout-1.0.0-r0.apk",
+        "version": "1.0.0-r0",
+        "architecture": "x86_64",
+        "signature": {
+          "range": "bytes=0-684",
+          "checksum": "sha1-e4mtQNHHROPVjqH3vNZUtKTu5Uc="
+        },
+        "control": {
+          "range": "bytes=685-964",
+          "checksum": "sha1-cs+Hlyu5sY+1mmwKPedcRWj8E24="
+        },
+        "data": {
+          "range": "bytes=965-2899",
+          "checksum": "sha256-6Gbikm5tHIqetbTVz/wPcmtCcrO17ed1vPM6xuR0IrU="
+        },
+        "checksum": "Q1cs+Hlyu5sY+1mmwKPedcRWj8E24="
+      },
+      {
+        "name": "replayout",
+        "url": "./testdata/packages/x86_64/replayout-1.0.0-r0.apk",
+        "version": "1.0.0-r0",
+        "architecture": "x86_64",
+        "signature": {
+          "range": "bytes=0-684",
+          "checksum": "sha1-UCaIAliqYaIrol8/H5PAi8J5ihg="
+        },
+        "control": {
+          "range": "bytes=685-974",
+          "checksum": "sha1-ADqt8AXOdbDPVa9UeGNJngcURrk="
+        },
+        "data": {
+          "range": "bytes=975-2848",
+          "checksum": "sha256-irIVeq+6d/ZEIg59H1sjgVycwhfmwYwD79+Gv5DJXb0="
+        },
+        "checksum": "Q1ADqt8AXOdbDPVa9UeGNJngcURrk="
+      },
+      {
+        "name": "pretend-baselayout",
+        "url": "./testdata/packages/aarch64/pretend-baselayout-1.0.0-r0.apk",
+        "version": "1.0.0-r0",
+        "architecture": "aarch64",
+        "signature": {
+          "range": "bytes=0-683",
+          "checksum": "sha1-HFPvVMM/+d7Rm+XbuxpEyWM4wR4="
+        },
+        "control": {
+          "range": "bytes=684-961",
+          "checksum": "sha1-IhHX8PA1MiPcnOa5ig/Wjr/qhbU="
+        },
+        "data": {
+          "range": "bytes=962-2900",
+          "checksum": "sha256-HxWjXtCvMsSYOmhE5OUPz9KQ4kpm0Ywg17OzSf3Ikl4="
+        },
+        "checksum": "Q1IhHX8PA1MiPcnOa5ig/Wjr/qhbU="
+      },
+      {
+        "name": "replayout",
+        "url": "./testdata/packages/aarch64/replayout-1.0.0-r0.apk",
+        "version": "1.0.0-r0",
+        "architecture": "aarch64",
+        "signature": {
+          "range": "bytes=0-688",
+          "checksum": "sha1-1N7VDS5GSkkT4bzQ5ZJ5VzWiR6w="
+        },
+        "control": {
+          "range": "bytes=689-977",
+          "checksum": "sha1-twZgE0XMokZ89rlCxtGjp+XgtIc="
+        },
+        "data": {
+          "range": "bytes=978-2849",
+          "checksum": "sha256-Mkciu4YKl5ibdvTTg7BQOBSN2xVT1GC5VBZ3/D4qz24="
+        },
+        "checksum": "Q1twZgE0XMokZ89rlCxtGjp+XgtIc="
+      }
+    ]
+  }
+}

internal/cli/testdata/apko.pre-0.13.lock.json

@@ -0,0 +1,97 @@
+{
+  "version": "v1",
+  "contents": {
+    "keyring": [
+      {
+        "name": "./testdata/melange.rsa.pub",
+        "url": "./testdata/melange.rsa.pub"
+      }
+    ],
+    "repositories": [
+      {
+        "name": "./testdata/packages/x86_64",
+        "url": "./testdata/packages/x86_64/APKINDEX.tar.gz",
+        "architecture": "x86_64"
+      },
+      {
+        "name": "./testdata/packages/aarch64",
+        "url": "./testdata/packages/aarch64/APKINDEX.tar.gz",
+        "architecture": "aarch64"
+      }
+    ],
+    "packages": [
+      {
+        "name": "pretend-baselayout",
+        "url": "./testdata/packages/x86_64/pretend-baselayout-1.0.0-r0.apk",
+        "version": "1.0.0-r0",
+        "architecture": "x86_64",
+        "signature": {
+          "range": "bytes=0-684",
+          "checksum": "sha1-e4mtQNHHROPVjqH3vNZUtKTu5Uc="
+        },
+        "control": {
+          "range": "bytes=685-964",
+          "checksum": "sha1-cs+Hlyu5sY+1mmwKPedcRWj8E24="
+        },
+        "data": {
+          "range": "bytes=965-2899",
+          "checksum": "sha256-6Gbikm5tHIqetbTVz/wPcmtCcrO17ed1vPM6xuR0IrU="
+        }
+      },
+      {
+        "name": "replayout",
+        "url": "./testdata/packages/x86_64/replayout-1.0.0-r0.apk",
+        "version": "1.0.0-r0",
+        "architecture": "x86_64",
+        "signature": {
+          "range": "bytes=0-684",
+          "checksum": "sha1-UCaIAliqYaIrol8/H5PAi8J5ihg="
+        },
+        "control": {
+          "range": "bytes=685-974",
+          "checksum": "sha1-ADqt8AXOdbDPVa9UeGNJngcURrk="
+        },
+        "data": {
+          "range": "bytes=975-2848",
+          "checksum": "sha256-irIVeq+6d/ZEIg59H1sjgVycwhfmwYwD79+Gv5DJXb0="
+        }
+      },
+      {
+        "name": "pretend-baselayout",
+        "url": "./testdata/packages/aarch64/pretend-baselayout-1.0.0-r0.apk",
+        "version": "1.0.0-r0",
+        "architecture": "aarch64",
+        "signature": {
+          "range": "bytes=0-683",
+          "checksum": "sha1-HFPvVMM/+d7Rm+XbuxpEyWM4wR4="
+        },
+        "control": {
+          "range": "bytes=684-961",
+          "checksum": "sha1-IhHX8PA1MiPcnOa5ig/Wjr/qhbU="
+        },
+        "data": {
+          "range": "bytes=962-2900",
+          "checksum": "sha256-HxWjXtCvMsSYOmhE5OUPz9KQ4kpm0Ywg17OzSf3Ikl4="
+        }
+      },
+      {
+        "name": "replayout",
+        "url": "./testdata/packages/aarch64/replayout-1.0.0-r0.apk",
+        "version": "1.0.0-r0",
+        "architecture": "aarch64",
+        "signature": {
+          "range": "bytes=0-688",
+          "checksum": "sha1-1N7VDS5GSkkT4bzQ5ZJ5VzWiR6w="
+        },
+        "control": {
+          "range": "bytes=689-977",
+          "checksum": "sha1-twZgE0XMokZ89rlCxtGjp+XgtIc="
+        },
+        "data": {
+          "range": "bytes=978-2849",
+          "checksum": "sha256-Mkciu4YKl5ibdvTTg7BQOBSN2xVT1GC5VBZ3/D4qz24="
+        }
+      }
+    ]
+  }
+}

internal/cli/testdata/tzdata.yaml → internal/cli/testdata/apko.yaml

@@ -1,10 +1,10 @@
 contents:
   keyring:
-    - ./testdata/local-melange.rsa.pub
+    - ./testdata/melange.rsa.pub
   repositories:
     - ./testdata/packages
   packages:
-    - tzdata
+    - replayout
 
 entrypoint:
   command: /bin/sh -l

internal/cli/testdata/melange.rsa

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJJwIBAAKCAgEAuE9aHvpBoe7HNnWxhp2px+HGjbPhzP0CyQYMNMcHjd76UcaP
+wWNTVqJI8JMT2u72mPsEXpC+J6KqjIggJoOaQYg87oYEdthoJZjyDaKzezNZKndz
+VQkg4RfQPiCPQkm4r9v6So0MCDa4rwRYnqrfs3Je9/wi8B/wG1sz7P4wOG23djxp
+ORDsMI9CyZhnAKfNg/uqmF/sxEwOL4FaDZMg0oo7Kx3FjtqqKTV8uFbCDsTxV3CR
+0pm3WJdX9TNfjXLXfp2a6QDYk1JoYl++UUHK+7izMXro6xgY7OPT+F48/YNYxS/c
+iH90DmN7ysJnQ2otZHSqhOkJV4UrYCKBHY55XjpDe7+nmwXaqVyAlCS6pDqHeYUU
+pYTpnv4b9bbst9NtYPRY8W00Oc5Cs3KdHeV6LqvHAGwNTZziv91UTpi0hMf27I+M
+LaXx+jNWm5j40a+ZyswLAQSLI+u3LxfPlHdalhpaQw+CoM3ucX9rcnJaBgowXclD
+AAvRNIj7EJNW5sk+3SbpmKKDkrD7Cl0rMSrd1dixDZZPzA8UtwheNTmV+I+0r1kQ
+McNYcB8iUKsoWIpaur0CBCww02WTHpOMcMGw+rVr/wzPP3Iqo1+EVrzVI5kSnZ7V
+LRtO5VdMLw0PlIK4ShJ+X5OtVtWnJ9jIiLaIse0tr8lpqU40eV862X+jKz0CAwEA
+AQKCAgBi98Elty28/VGdba9I4KpFOXf7qSbLguSW+xdc0667wIrblGqm5mXetD/E
+ZsWXnw9tcASVntVsxQ0dbw8Mf0g6fiRx1CbbhjLOVYVMSxxjQFxV0FRuyfsMw1O/
+uI4Ugy+XxuBsXbajRnb/C69ma8y5N+XE9W/xTsUIe32zeX59HnUQGTpLOUoKfTLY
+u2w7zt8tStr8/S1O7qQDYErx1Rof07gX2+G0ZrhObnktJvEHKzuIv1qeIopwGLxT
+XyWk95C9XXXMPfcNjIeeo1i3m0OazT/zhtNBQexIb8HnsPrBCmGFaMDbzsyL2WGk
+q6T1bzM2qOrTearZgxmagoygSVvjklwhy9TU7bAuCRnSqKOuPaU18yqhBUedD250
+tuFGWjY6zjD4Z7Omn8e7mse8c4F4qZO/9SU+dt0TQcC6mSBb18tjkgJqZ0lhS69O
+LtVrMM/SdJ60z/LKPRBZs3ccHAjRemDq+WH7i8JE6luug8pp307nBwDoyCrF3grW
+Lw6qYgmT4tBmzG/HnjxtpFego5WLkV7CTT2V2heZuxBrNcr8nXWRckk1YrGsiYdA
+boI7uHzQGVmjywR1yRE9Bw/SOxH+GtIPE/pPd7biTMN6/fQIC77tDo+1HpTkGYxZ
+vROeI23NGSmqMWyDzpnongUT2npLxMcEXx3JOFEyDc+Ov3ja4QKCAQEAzBfcEe+T
+SORi69+UFDdV0u4rmWuLwZvSFo9vVdfgfGFe2HLN27Vfehz7UPn1aNoUbe68VgER
+PyWfwt5bP13TZ4dp89LmyZcP427h5km3bNk6tILC3IlHsFky4uv135D6uxYyO0VW
+cnkQG9Fj/4JsQ4eXqcPNXQLD6lXCVWXsst7QVrdyjw4fdFqrfXLRWYp77HJvdiqi
+jnnCSdgag1aBl5S479fzPwGGoJdUJiAxeAhdtIIPTiEWYQq0IuLmnSndMY9oKB1v
+zxJlpxXgD2DSBQmJCNlBgGhEod8+ELkzv26hz0L0BIsOxiVcX58dHiJPj7pV9GUo
+rA7gWu7WALkKqQKCAQEA5y9xF6d0BD6yGDM2xBr/MHf/OoUn0W0x7wJHEOiD8qkf
+6O9SiRQS9ysSEDoNoJWRU4NF59D619p0pl2fLtzWJC+Of9VEM09Sl8YS+IBIfTQS
+9z8UQdW+7lFUQJStxEPPGaye7by2cAwEhj8NYhFIiRMCcdEJ5MehcrWZXDCtYQjZ
+ojnGe1mpK6WwcDEJuopNaUGJhEQhHfr9OLilbBUB3BR6Bh7Z2/RGNvhD+suY6AX9
+kyt/XQ8zkzlGXPxQpSfJryE2GszVOycf8reTMNcsTDEdKLiyvM7DHUJ99s5e6FDZ
+FwTWGiGu7CH8pmeY3GxrnEo/l3ky7sn1AP9BY0JsdQKCAQANwVnqt4vksMfd/96a
+EjStl7HGkFIGBXt+W8J0Na2ClIlw6yPmt+2sbEGf7ojUvUX9NsbowP+pkt6Woqfh
+uHAkHSNN9JvrYEwI1xNQkw1Sv71OJzX86R+0yf48/ww+OiY7774I8p5l7rTgOxeT
+Q/YKAxx8q56usx4DMC591PXEBHJkNc75x0jlbar7NH7ZmxTJFdlfTHZSRfCLS45V
+5cGsNrDUMWjKiU7Kigh43ViYL3ApV06yxFYeyjrj0wkZ9JVc3r51Xa6IdUP2o+nK
+/4qIHmFnAEWC4wQlKMelFuZe85TiRC/wEnM3dZMpOq8atdNI65UZeKvqFMKYPlqc
+B9ypAoIBACwYLGXqloJIwwdCnWuCCrJf8Npkk1eqkB+aO5vJ/YDHKULwgrmKjqN+
+H4/gwsCiRnm7TBYPEgkhraYdrULu9BkqyO8w6jUvJ/2y1eN39FuNFyD5cw+riSND
+d+JpeUs588Jd3mJR4Co24JYKaK8PxNoAOjMjP9PXD8AlSv7+edNMMNZ0VpsoWs/s
+Zl6/u69Mub8dtPD5XaeuO6YZ8dNPnm8vqKaKM9t0GABcEfs/4gY/PkJXxY8mWxv1
+jKonpeoaUKmKmBs8fl8t8zYENZrXL6fIplsh/1VrymNGT2hHrGp7ISz2yy9oxUhc
+oyfKEqnYNB43OzHU+BX7hzONfBdGkBECggEACsfXS/ey47myNEfIvMOa64ZA+VDC
+QGGGL1hwyKp+0DXwmoj/U6pkEu9EZcYF3OXTVYRIdA6+Hxks6JQRgmrNlID/vPC3
+lfpvnRXWVJ5cDd68v6fooHOT/Hjg5hlVpXXM8Gsd+mBQtPrYbpnVvYqH7FVUkyfN
+3nbLV3q3QsTvA3BR1swSMSbDzO03adUZJ1zO01BtlYn787L1RHMdNdEfKld/XTVd
+yuxGbAfzOTWGJB2+qV4RzbN1xTEJGdgKgX7zrq+7cpnz8njiIU2xB34Tm+Nlb43I
+IvNCFo4H/f1TAP3rru4AGv6cAu1w6c+8mpzqpqk+OZ2evtvSgHVZ01DFIg==
+-----END RSA PRIVATE KEY-----

internal/cli/testdata/melange.rsa.pub

@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuE9aHvpBoe7HNnWxhp2p
+x+HGjbPhzP0CyQYMNMcHjd76UcaPwWNTVqJI8JMT2u72mPsEXpC+J6KqjIggJoOa
+QYg87oYEdthoJZjyDaKzezNZKndzVQkg4RfQPiCPQkm4r9v6So0MCDa4rwRYnqrf
+s3Je9/wi8B/wG1sz7P4wOG23djxpORDsMI9CyZhnAKfNg/uqmF/sxEwOL4FaDZMg
+0oo7Kx3FjtqqKTV8uFbCDsTxV3CR0pm3WJdX9TNfjXLXfp2a6QDYk1JoYl++UUHK
++7izMXro6xgY7OPT+F48/YNYxS/ciH90DmN7ysJnQ2otZHSqhOkJV4UrYCKBHY55
+XjpDe7+nmwXaqVyAlCS6pDqHeYUUpYTpnv4b9bbst9NtYPRY8W00Oc5Cs3KdHeV6
+LqvHAGwNTZziv91UTpi0hMf27I+MLaXx+jNWm5j40a+ZyswLAQSLI+u3LxfPlHda
+lhpaQw+CoM3ucX9rcnJaBgowXclDAAvRNIj7EJNW5sk+3SbpmKKDkrD7Cl0rMSrd
+1dixDZZPzA8UtwheNTmV+I+0r1kQMcNYcB8iUKsoWIpaur0CBCww02WTHpOMcMGw
++rVr/wzPP3Iqo1+EVrzVI5kSnZ7VLRtO5VdMLw0PlIK4ShJ+X5OtVtWnJ9jIiLaI
+se0tr8lpqU40eV862X+jKz0CAwEAAQ==
+-----END PUBLIC KEY-----