feat: add build provenance tracking to engine images - #796
Merged
Conversation
Track which repo state produced each engine image by embedding provenance data as OCI annotations and a file inside the image at /etc/crucible/build-provenance.json. Provenance includes: - Source controller hostname and IP - Rickshaw client version (controller-side) with dirty detection - Rickshaw server version (service-side) with dirty detection - All contributing repos (benchmarks, tools, utilities, core) with commit hash, dirty flag, diff-hash, and full diff for dirty repos Changes: - rickshaw-run: compute provenance and include in source-images input - schema/source-images-input.json: add required provenance field - rickshaw-source-images-client: pass provenance through to API - source-images-service models: add Provenance/RepoProvenance models - image_sourcer: generate annotations and provenance file requirement, embed in last build stage Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The controller userenv was renamed from 'fedora' to 'crucible-controller' in crucible#545. The fedora entry was kept temporarily for backwards compatibility during the transition. Now that the rename is merged, the fedora entry is dead code. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add the provenance requirement alongside each stage's own requirement instead of appending it as a separate final stage. This ensures every intermediate stage image has both the provenance file and annotations, making all stages traceable to their source repos. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/etc/crucible/build-provenance.jsonfedorauserenv compat entry fromworkshop.json(crucible#545 renamed it tocrucible-controller)Files changed
rickshaw-run— compute provenance and include in source-images inputschema/source-images-input.json— add required provenance fieldrickshaw-source-images-client— pass provenance through to APIsource-images-service/models/requests.py— add Provenance modelssource-images-service/core/image_sourcer.py— generate annotations and provenance file, embed in last build stageworkshop.json— remove fedora compat entryTest plan
crucible run— provenance data written to source-images input JSON🤖 Generated with Claude Code