Switch melange and apko files to use cve0 APK repo (#5826)

Author: divolgin

.github/workflows/image-deps-updater.yaml

@@ -21,14 +21,8 @@ jobs:
       run: |
         set -euo pipefail
 
-        # We're only using the APKINDEX files to get the versions, so it doesn't matter which arch we use
-
-        curl -LO --fail --show-error https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz
-        tar -xzvf APKINDEX.tar.gz
-
-        minio_version=$(< APKINDEX grep -A1 "^P:minio$" | tail -n 1 | sed -n -e 's/V://p' | tr -d '\n')
-
-        sed "s/__MINIO_VERSION__/$minio_version/g" deploy/minio/apko.yaml.tmpl > deploy/minio/apko.yaml
+        # minio repo is now read-only and the version will never change
+        minio_version="0.20251015.172955"
 
         # Get latest rqlite version from registry
         rqlite_version=$(skopeo list-tags docker://proxy.replicated.com/library/rqlite | \

deploy/apko.yaml.tmpl

@@ -1,9 +1,9 @@
 contents:
   repositories:
-    - https://packages.wolfi.dev/os
+    - https://apk.cve0.io
     - ./packages/
   keyring:
-    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+    - https://apk.cve0.io/key/cve0-signing.rsa.pub
     - ./melange-arm64.rsa.pub
     - ./melange-amd64.rsa.pub
   packages:
@@ -14,10 +14,11 @@ contents:
     - curl
     - git
     - kustomize
-    - py3-dateutil
-    - py3-magic
-    - s3cmd
-    - wolfi-baselayout
+    - py3.14-magic
+    - py3-six-1.16-six3.14
+    - s3cmd-2.4-py3.14
+    - securebuild-baselayout
+    - helm~4
 
 accounts:
   groups:
@@ -32,6 +33,16 @@ accounts:
 environment:
   VERSION: ${GIT_TAG}
 
+paths:
+  - path: /usr/local/bin/helm
+    type: symlink
+    source: /usr/bin/helm
+    permissions: 0o755
+  - path: /usr/local/bin/kustomize
+    type: symlink
+    source: /usr/bin/kustomize
+    permissions: 0o755
+
 entrypoint:
   command: /kotsadm
 

deploy/melange.yaml.tmpl

@@ -9,16 +9,17 @@ package:
 environment:
   contents:
     repositories:
-      - https://packages.wolfi.dev/os
+      - https://apk.cve0.io
     keyring:
-      - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+      - https://apk.cve0.io/key/cve0-signing.rsa.pub
     packages:
       - ca-certificates-bundle
+      - bash
       - busybox
       - curl
       - git
       - go
-      - nodejs-24
+      - nodejs~24
       - yarn
 
 pipeline:
@@ -35,7 +36,7 @@ pipeline:
       export GIT_TAG=${GIT_TAG}
 
       # Set environment variables from repository
-      source .image.env
+      . ./.image.env
 
       # TODO: fix pact build error on arm https://github.com/pact-foundation/pact-js-core/issues/264
       export PACT_SKIP_BINARY_INSTALL=true
@@ -49,10 +50,3 @@ pipeline:
 
       mv bin/kotsadm "${DESTDIR}/kotsadm"
       mv bin/kots "${DESTDIR}/kots"
-
-      make helm
-      mkdir -p "${DESTDIR}/usr/bin"
-      mv bin/helm "${DESTDIR}/usr/bin/helm"
-
-      ln -s /usr/bin/helm ${DESTDIR}/usr/local/bin/helm
-      ln -s /usr/bin/kustomize ${DESTDIR}/usr/local/bin/kustomize

deploy/minio/apko.yaml.tmpl

@@ -1,13 +1,23 @@
 contents:
   repositories:
-    - https://packages.wolfi.dev/os
+    - https://apk.cve0.io
   keyring:
-    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+    - https://apk.cve0.io/key/cve0-signing.rsa.pub
   packages:
-    - minio=__MINIO_VERSION__
-    - mc
-    - bash
+    - minio~0.20251015.172955
+    - minio-oci-entrypoint~0.20251015.172955
+    - ca-certificates-bundle
+    - securebuild-baselayout
     - busybox
+    - coreutils
+    - glibc
+
+entrypoint:
+  command: /usr/bin/docker-entrypoint.sh
+
+cmd: minio
+
+stop-signal: SIGTERM
 
 accounts:
   groups:
@@ -19,5 +29,12 @@ accounts:
       gid: 1001
   run-as: minio
 
-entrypoint:
-  command: minio
+volumes:
+  - /data
+
+paths:
+  - path: /data
+    type: directory
+    permissions: 0o755
+
+work-dir: /

kurl_proxy/deploy/apko.yaml.tmpl

@@ -1,9 +1,9 @@
 contents:
   repositories:
-    - https://packages.wolfi.dev/os
+    - https://apk.cve0.io
     - ./packages/
   keyring:
-    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+    - https://apk.cve0.io/key/cve0-signing.rsa.pub
     - ./melange-arm64.rsa.pub
     - ./melange-amd64.rsa.pub
   packages:
@@ -12,7 +12,7 @@ contents:
     - busybox
     - curl
     - git
-    - wolfi-baselayout
+    - securebuild-baselayout
 
 accounts:
   groups:

kurl_proxy/deploy/melange.yaml.tmpl

@@ -9,13 +9,14 @@ package:
 environment:
   contents:
     repositories:
-      - https://packages.wolfi.dev/os
+      - https://apk.cve0.io
     keyring:
-      - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+      - https://apk.cve0.io/key/cve0-signing.rsa.pub
     packages:
       - ca-certificates-bundle
       - busybox
       - git
+      - bash
       - go
 
 pipeline: