feat: add :flat target for flattened packages

.bcr/presubmit.yml

@@ -2,8 +2,7 @@ bcr_test_module:
   module_path: "e2e/smoke"
   matrix:
     platform: ["debian10", "macos", "ubuntu2004"]
-    # last_rc is to get latest 8.x release. Replace with 8.x when available.
-    bazel: [7.x, last_rc]
+    bazel: [7.x, 8.x]
   tasks:
     run_tests:
       name: "Run test module"

MODULE.bazel

@@ -29,7 +29,7 @@ use_repo(bazel_lib_toolchains, "yq_windows_amd64")
 bazel_dep(name = "gazelle", version = "0.34.0", dev_dependency = True, repo_name = "bazel_gazelle")
 bazel_dep(name = "bazel_skylib_gazelle_plugin", version = "1.5.0", dev_dependency = True)
 bazel_dep(name = "buildifier_prebuilt", version = "6.1.2", dev_dependency = True)
-bazel_dep(name = "rules_oci", version = "2.0.0-rc0", dev_dependency = True)
+bazel_dep(name = "rules_oci", version = "2.0.0", dev_dependency = True)
 bazel_dep(name = "container_structure_test", version = "1.16.0", dev_dependency = True)
 bazel_dep(name = "bazel_features", version = "1.20.0", dev_dependency = True)
 
@@ -71,19 +71,14 @@ apt.install(
     manifest = "//examples/debian_snapshot:bullseye_nolock.yaml",
     nolock = True,
 )
-apt.install(
-    name = "apt_security",
-    manifest = "//examples/debian_snapshot_security:security.yaml",
-    nolock = True,
-)
-apt.install(
-    name = "shared_dependencies",
-    lock = "//examples/debian_shared_dependencies:bullseye.lock.json",
-    manifest = "//examples/debian_shared_dependencies:bullseye.yaml",
-)
 apt.install(
     name = "noble",
     lock = "//examples/ubuntu_snapshot:noble.lock.json",
     manifest = "//examples/ubuntu_snapshot:noble.yaml",
 )
-use_repo(apt, "apt_security", "apt_security_resolve", "bullseye", "bullseye_nolock", "noble", "shared_dependencies")
+apt.install(
+    name = "resolution_test",
+    manifest = "apt/tests/resolution/security.yaml",
+    nolock = True,
+)
+use_repo(apt, "bullseye", "bullseye_nolock", "noble", "resolution_test", "resolution_test_resolve")

apt/private/apt_deb_repository.bzl

@@ -10,11 +10,12 @@ def _fetch_package_index(rctx, url, dist, comp, arch, integrity):
     #  --keep       -> keep the original file (Bazel might be still committing the output to the cache)
     #  --force      -> overwrite the output if it exists
     #  --decompress -> decompress
+    # Order of these matter, we want to try the one that is most likely first.
     supported_extensions = {
-        "": ["true"],
         ".xz": ["xz", "--decompress", "--keep", "--force"],
         ".gz": ["gzip", "--decompress", "--keep", "--force"],
         ".bz2": ["bzip2", "--decompress", "--keep", "--force"],
+        "": ["true"],
     }
 
     failed_attempts = []

apt/private/deb_translate_lock.bzl

@@ -41,6 +41,7 @@ _ROOT_BUILD_TMPL = """\
 "Generated by rules_distroless. DO NOT EDIT."
 
 load("@rules_distroless//apt:defs.bzl", "dpkg_status")
+load("@rules_distroless//distroless:defs.bzl", "flatten")
 
 exports_files(['packages.bzl'])
 
@@ -105,6 +106,15 @@ filegroup(
     ],
     visibility = ["//visibility:public"],
 )
+
+flatten(
+    name = "flat",
+    tars = [
+        "{target_name}",
+    ],
+    deduplicate = True,
+    visibility = ["//visibility:public"],
+)
 """
 
 def _deb_translate_lock_impl(rctx):

examples/debian_snapshot_security/BUILD.bazel → apt/tests/resolution/BUILD.bazel

@@ -4,7 +4,7 @@ load("@aspect_bazel_lib//lib:testing.bzl", "assert_contains")
 jq(
     name = "pick_libuuid_version",
     srcs = [
-        "@apt_security_resolve//:lockfile",
+        "@resolution_test_resolve//:lockfile",
     ],
     args = ["-rj"],
     filter = '.packages | map(select(.name == "libuuid1")) | .[0].version',

distroless/private/flatten.bzl

@@ -12,12 +12,12 @@ def _flatten_impl(ctx):
 
     args = ctx.actions.args()
     args.add(bsdtar.tarinfo.binary)
-    args.add(output if ctx.attr.deduplicate else "-")
+    args.add(str(ctx.attr.deduplicate))
     args.add_all(tar_lib.DEFAULT_ARGS)
     args.add("--create")
     tar_lib.common.add_compression_args(ctx.attr.compress, args)
     tar_lib.add_default_compression_args(ctx.attr.compress, args)
-    args.add("--file", "-" if ctx.attr.deduplicate else output)
+    args.add("--file", output)
     args.add_all(ctx.files.tars, format_each = "@%s")
 
     ctx.actions.run(
@@ -26,6 +26,8 @@ def _flatten_impl(ctx):
         outputs = [output],
         tools = bsdtar.default.files,
         arguments = [args],
+        mnemonic = "Flatten",
+        progress_message = "Flattening %{label}}",
     )
 
     return [

distroless/private/flatten.sh

@@ -2,11 +2,11 @@
 set -o pipefail -o errexit
 
 bsdtar="$1";
-output="$2";
+deduplicate="$2";
 shift 2;
 
 # Deduplication requested, use this complex pipeline to deduplicate.
-if [[ "$output" != "-" ]]; then
+if [[ "$deduplicate" == "True" ]]; then
 
     mtree=$(mktemp)
 
@@ -33,7 +33,7 @@ if [[ "$output" != "-" ]]; then
     # number of occurrences of each path, and the second pass determines whether each entry is the final (or only)
     # occurrence of that path.
 
-    $bsdtar --confirmation "$@" > $output 2< <(awk '{
+    $bsdtar --confirmation "$@" 2< <(awk '{
         count[$1]++;
         files[NR] = $1
     }
@@ -52,5 +52,5 @@ if [[ "$output" != "-" ]]; then
     rm "$mtree"
 else 
     # No deduplication, business as usual
-    $bsdtar $@
+    $bsdtar "$@"
 fi