Bump go-apk

.github/workflows/build-samples.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v2.4.0
       - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v2.1.5
         with:
-          go-version: 1.19
+          go-version: "1.20"
           check-latest: true
       - name: Setup QEMU
         uses: docker/[email protected]
@@ -44,7 +44,7 @@ jobs:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v2.4.0
       - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v2.1.5
         with:
-          go-version: 1.19
+          go-version: "1.20"
           check-latest: true
       - name: build
         run: |
@@ -67,7 +67,7 @@ jobs:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v2.4.0
       - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v2.1.5
         with:
-          go-version: 1.19
+          go-version: "1.20"
           check-latest: true
       - name: Setup QEMU
         uses: docker/[email protected]
@@ -109,7 +109,7 @@ jobs:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v2.4.0
       - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v2.1.5
         with:
-          go-version: 1.19
+          go-version: "1.20"
           check-latest: true
       - name: Setup QEMU
         uses: docker/[email protected]
@@ -150,7 +150,7 @@ jobs:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v2.4.0
       - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v2.1.5
         with:
-          go-version: 1.19
+          go-version: "1.20"
           check-latest: true
       - uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c # v0.3
       - uses: chainguard-dev/actions/setup-registry@main

.github/workflows/build.yaml

@@ -14,7 +14,7 @@ jobs:
 
       - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v2.1.5
         with:
-          go-version: 1.19
+          go-version: "1.20"
           check-latest: true
 
       - name: build

.github/workflows/codeql.yaml

@@ -17,7 +17,7 @@ jobs:
 
     - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v3.0.0
       with:
-        go-version: 1.19
+        go-version: "1.20"
         check-latest: true
 
     - name: Initialize CodeQL

.github/workflows/go-tests.yaml

@@ -13,7 +13,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v3.0.0
       with:
-        go-version: 1.19
+        go-version: "1.20"
         check-latest: true
 
     - name: Checkout code

.github/workflows/release.yaml

@@ -9,7 +9,7 @@ on:
     - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
 
 env:
-  GO_VERSION: 1.19
+  GO_VERSION: "1.20"
 
 jobs:
   cli:

.github/workflows/verify.yaml

@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v2.4.0
       - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v2.2.0
         with:
-          go-version: 1.19
+          go-version: "1.20"
           check-latest: true
       - name: golangci-lint
         uses: golangci/golangci-lint-action@639cd343e1d3b897ff35927a75193d57cfcba299 # v3.1.0

go.mod

@@ -1,11 +1,11 @@
 module chainguard.dev/apko
 
-go 1.19
+go 1.20
 
 require (
 	github.com/avast/retry-go v3.0.0+incompatible
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220920003936-cd2dbcbbab49
-	github.com/chainguard-dev/go-apk v0.0.0-20230705205018-0f562819b08c
+	github.com/chainguard-dev/go-apk v0.0.0-20230708201701-3c93c31bf093
 	github.com/chrismellard/docker-credential-acr-env v0.0.0-20220327082430-c57b701bfc08
 	github.com/dominodatalab/os-release v0.0.0-20190522011736-bcdb4a3e3c2f
 	github.com/go-git/go-git/v5 v5.6.1

go.sum

@@ -100,8 +100,8 @@ github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220920003936-
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
-github.com/chainguard-dev/go-apk v0.0.0-20230705205018-0f562819b08c h1:bHONFcO1CmiydEKI8/GEHnat45shDojOM7Pjjvbho/A=
-github.com/chainguard-dev/go-apk v0.0.0-20230705205018-0f562819b08c/go.mod h1:sNZqgAX8clMvo10Lg0NmoO4ry71+S/LmIgrPZogBMzs=
+github.com/chainguard-dev/go-apk v0.0.0-20230708201701-3c93c31bf093 h1:d5z7d9V2CixzAhnUYoGRl4Ftp8g48N+M50UzKqQxKAk=
+github.com/chainguard-dev/go-apk v0.0.0-20230708201701-3c93c31bf093/go.mod h1:sNZqgAX8clMvo10Lg0NmoO4ry71+S/LmIgrPZogBMzs=
 github.com/chrismellard/docker-credential-acr-env v0.0.0-20220327082430-c57b701bfc08 h1:9Qh4lJ/KMr5iS1zfZ8I97+3MDpiKjl+0lZVUNBhdvRs=
 github.com/chrismellard/docker-credential-acr-env v0.0.0-20220327082430-c57b701bfc08/go.mod h1:MAuu1uDJNOS3T3ui0qmKdPUwm59+bO19BbTph2wZafE=
 github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I=

internal/cli/build.go

@@ -278,7 +278,6 @@ func buildImageComponents(ctx context.Context, wd string, archs []types.Architec
 			if err != nil {
 				return fmt.Errorf("failed to build layer image for %q: %w", arch, err)
 			}
-			imageTars[arch] = layerTarGZ
 
 			// Compute the "build date epoch" from the packages that were
 			// installed.  The "build date epoch" is the MAX of the builddate
@@ -301,6 +300,7 @@ func buildImageComponents(ctx context.Context, wd string, archs []types.Architec
 			}
 			mtx.Lock()
 			imgs[arch] = img
+			imageTars[arch] = layerTarGZ
 			mtx.Unlock()
 
 			return nil