Merge pull request #1184 from sfc-gh-mhazy/apko-on-top-users

Don't mutate accounts if base image is set

internal/cli/testdata/top_image/blobs/sha256/187fd84e9e1772f5e76bd7c4f4c29a884885ece66514a9a3b7fc7a541fb11dd1 → internal/cli/testdata/top_image/blobs/sha256/149f310693ee8812c28e4e23ee1bf0b35141ac2c19e1a665ff5baadb3fd8a68e

@@ -1 +1 @@
-{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","size":716,"digest":"sha256:b185458f4501b9994baca82caf05a6c9f52e23430bd2d8f7fbbd9de11c8ef44b"},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","size":4123,"digest":"sha256:583625b6164fff3b017f62b9fcd60cb53fff18a7e89ee538212134a13fc29fb1"},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","size":2870,"digest":"sha256:ed2f299f342176fbf18b074fe3c40bc59a361d6a109a7af767e8fd8aa29c1184"}]}
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","size":716,"digest":"sha256:68daf87e56a0a846927c0535c9beaa4d90b7500739d79766b757b8253e7c84d7"},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","size":4123,"digest":"sha256:583625b6164fff3b017f62b9fcd60cb53fff18a7e89ee538212134a13fc29fb1"},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","size":2845,"digest":"sha256:d509688b2e26be6f4c6e8eb1f8e3f1f1cc563712dfa095cc461d5c37a29057b0"}]}

internal/cli/testdata/top_image/blobs/sha256/9c4e08d7a6ddc5ffe7bedfe52f1d8c344eace518f8a8d4ddcb231f191e558566 → internal/cli/testdata/top_image/blobs/sha256/1b8f0b6e368cf22d86aaeb2181defed3ffe4bed0383d7acf05b8850881b60a10

@@ -1 +1 @@
-{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","size":716,"digest":"sha256:5f00660705c7553f86f6858fdc93c697a394ebc6753b1a634f46e766c9cd4867"},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","size":4126,"digest":"sha256:bf74ddaf55d32ec9672a0a40efc6cb1bf0a167763c18fc22586c8a301167822f"},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","size":2866,"digest":"sha256:9306473ad3e39b7a0a57a9cd06b119c79d1c85c3c955f3d518e3bf5fe79ba799"}]}
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","size":716,"digest":"sha256:a54af7ae5da36e1d6feaf559438cd1b84a27223cd4518f4c875de82bcdc31017"},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","size":4126,"digest":"sha256:bf74ddaf55d32ec9672a0a40efc6cb1bf0a167763c18fc22586c8a301167822f"},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","size":2840,"digest":"sha256:97502a24c34c7cd4d1c3f29dbba3b123c4da15d2bd3bbe723bfddb949713342a"}]}

internal/cli/testdata/top_image/blobs/sha256/b185458f4501b9994baca82caf05a6c9f52e23430bd2d8f7fbbd9de11c8ef44b → internal/cli/testdata/top_image/blobs/sha256/68daf87e56a0a846927c0535c9beaa4d90b7500739d79766b757b8253e7c84d7

@@ -1 +1 @@
-{"architecture":"arm64","author":"github.com/chainguard-dev/apko","created":"1970-01-01T00:00:00Z","history":[{"author":"apko","created":"1970-01-01T00:00:00Z","created_by":"apko","comment":"This is an apko single-layer image"},{"author":"apko","created":"1970-01-01T00:00:00Z","created_by":"apko","comment":"This is an apko single-layer image"}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:2888aac57b90cf66093aa48092bf1f1f1b1bdb85bde8601a5f8cf0f06c814763","sha256:17fea8af193693cbc59fa769361c0a0bc5cdca0bdf163abfa7e684dafe1f15cb"]},"config":{"Entrypoint":["/bin/sh","-l"],"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt"]}}
+{"architecture":"arm64","author":"github.com/chainguard-dev/apko","created":"1970-01-01T00:00:00Z","history":[{"author":"apko","created":"1970-01-01T00:00:00Z","created_by":"apko","comment":"This is an apko single-layer image"},{"author":"apko","created":"1970-01-01T00:00:00Z","created_by":"apko","comment":"This is an apko single-layer image"}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:2888aac57b90cf66093aa48092bf1f1f1b1bdb85bde8601a5f8cf0f06c814763","sha256:3545f2e3eb427fe9d3521abc55a45728969e1556a90e38bd4db481d8cdaba687"]},"config":{"Entrypoint":["/bin/sh","-l"],"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt"]}}

internal/cli/testdata/top_image/blobs/sha256/5f00660705c7553f86f6858fdc93c697a394ebc6753b1a634f46e766c9cd4867 → internal/cli/testdata/top_image/blobs/sha256/a54af7ae5da36e1d6feaf559438cd1b84a27223cd4518f4c875de82bcdc31017

@@ -1 +1 @@
-{"architecture":"amd64","author":"github.com/chainguard-dev/apko","created":"1970-01-01T00:00:00Z","history":[{"author":"apko","created":"1970-01-01T00:00:00Z","created_by":"apko","comment":"This is an apko single-layer image"},{"author":"apko","created":"1970-01-01T00:00:00Z","created_by":"apko","comment":"This is an apko single-layer image"}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:783b8b05724ae7998917558527ef930f1442af2f071850913fc406992e44606c","sha256:66ca7905bb8bc52e2637bbd0b6a31c3206511cad55acbd553bca8faa3e11933d"]},"config":{"Entrypoint":["/bin/sh","-l"],"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt"]}}
+{"architecture":"amd64","author":"github.com/chainguard-dev/apko","created":"1970-01-01T00:00:00Z","history":[{"author":"apko","created":"1970-01-01T00:00:00Z","created_by":"apko","comment":"This is an apko single-layer image"},{"author":"apko","created":"1970-01-01T00:00:00Z","created_by":"apko","comment":"This is an apko single-layer image"}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:783b8b05724ae7998917558527ef930f1442af2f071850913fc406992e44606c","sha256:eb2292e367ca689f6e10fadaa3b8901e9c9c4dd42ba1d30a72a3c1d4ae0b72c2"]},"config":{"Entrypoint":["/bin/sh","-l"],"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt"]}}

internal/cli/testdata/top_image/index.json

@@ -1 +1 @@
-{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"mediaType":"application/vnd.oci.image.manifest.v1+json","size":557,"digest":"sha256:9c4e08d7a6ddc5ffe7bedfe52f1d8c344eace518f8a8d4ddcb231f191e558566","platform":{"architecture":"amd64","os":"linux"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","size":557,"digest":"sha256:187fd84e9e1772f5e76bd7c4f4c29a884885ece66514a9a3b7fc7a541fb11dd1","platform":{"architecture":"arm64","os":"linux"}}]}
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"mediaType":"application/vnd.oci.image.manifest.v1+json","size":557,"digest":"sha256:1b8f0b6e368cf22d86aaeb2181defed3ffe4bed0383d7acf05b8850881b60a10","platform":{"architecture":"amd64","os":"linux"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","size":557,"digest":"sha256:149f310693ee8812c28e4e23ee1bf0b35141ac2c19e1a665ff5baadb3fd8a68e","platform":{"architecture":"arm64","os":"linux"}}]}

pkg/build/build_implementation.go

@@ -160,8 +160,13 @@ func (bc *Context) buildImage(ctx context.Context) error {
 		}
 	}
 
-	if err := mutateAccounts(bc.fs, &bc.ic); err != nil {
-		return fmt.Errorf("failed to mutate accounts: %w", err)
+	// For now adding additional accounts is banned when using base image. On the other hand, we don't want to
+	// wipe out the users set in base.
+	// If one wants to add a support for adding additional users they would need to look into this piece of code.
+	if bc.ic.Contents.BaseImage == nil {
+		if err := mutateAccounts(bc.fs, &bc.ic); err != nil {
+			return fmt.Errorf("failed to mutate accounts: %w", err)
+		}
 	}
 
 	if err := mutatePaths(bc.fs, &bc.o, &bc.ic); err != nil {