add flag to disable networking in build environment

[imjasonh]

Intended to be used alongside #143 where dependencies are pre-fetched.

Signed-off-by: Jason Hall [email protected]

[imjasonh]

Worth noting that this will still apk add any of the pipeline's dependencies, which might undermine some assumptions about how the flag works.

Should --disable-network also skip the apk add steps, and assume they're present in the apk cache location? 🤔

[kaniini]

I would rather have the melange.yaml file declare the desired capabilities, rather than have a CLI option for this. We can sync on it if you want.

[imjasonh]

I would rather have the melange.yaml file declare the desired capabilities, rather than have a CLI option for this. We can sync on it if you want.

I like that idea too, especially as we have more capabilities than just networking.

But even if we had those we should have some way to invoke melange explicitly without those capabilities, and rely on pre-caching the things fetch steps require. fetch is sort of an odd case in that way, it "requires" networking except when it doesn't. I'd like to think of a more holistic and generalized way to express that.

In the meantime, solving this isn't a huge blocker -- there's plenty to do to improve the build system, and even without disabling networking explicitly, I think we can attest we're building hermetically if we pre-cache. We can also disable networking at the Pod/K8s layer, instead of asking melange to do it, until we figure out the best way to do that.

[kaniini]

What about something like:

pipelines/fetch.yaml:

wants:
  packages:
    - wget
  capabilities:
    - net

...

package.yaml:

package: ...

wants:
  capabilities:
    - net

pipeline:
  - wants:
      capabilities:
        - something-else
    runs: ...

And then having a --deny-capabilities=net commandline option?

[imjasonh]

What about something like:

That sounds good. The current direction we're going (not too late to change though) would be that fetch would still run without the capability, we'd just depend on its cache lookup + digest checking logic to avoid actually calling wget.

If that's messy we can investigate some kind of --replace-pipeline=fetch=fetch-from-cache flag that swaps the pipeline step definition at call-time, for one that doesn't require the capability.

[kaniini]

Of note, by reusing the wants struct here, we could have pipeline elements declare their package requirements at the specific pipeline element requiring it, which could be interesting.