feat: build hermetically using new bldr and pkgs

Update bldr manually, fix builds with new base and use network only when needed (and verified by Go itself).

Signed-off-by: Dmitry Sharshakov <[email protected]>

Author: dsseng

.kres.yaml

@@ -2,6 +2,5 @@
 kind: pkgfile.Build
 spec:
   targets:
-    - install-cni
-    - talosctl-cni-bundle-install
-  reproducibleTargetName: reproducibility
+    - talosctl-cni-bundle
+  reproducibleTargetName: talosctl-cni-bundle

Makefile

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-01-21T11:42:07Z by kres 3075de9.
+# Generated on 2025-02-06T12:31:14Z by kres 987bf4d.
 
 # common variables
 
@@ -25,7 +25,7 @@ SOURCE_DATE_EPOCH := $(shell git log $(INITIAL_COMMIT_SHA) --pretty=%ct)
 
 # sync bldr image with pkgfile
 
-BLDR_RELEASE := v0.3.2
+BLDR_RELEASE := v0.4.0-1-g76a2c8f
 BLDR_IMAGE := ghcr.io/siderolabs/bldr:$(BLDR_RELEASE)
 BLDR := docker run --rm --user $(shell id -u):$(shell id -g) --volume $(PWD):/src --entrypoint=/bldr $(BLDR_IMAGE) --root=/src
 
@@ -44,8 +44,7 @@ COMMON_ARGS += --build-arg=SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH)
 
 # targets defines all the available targets
 
-TARGETS = install-cni
-TARGETS += talosctl-cni-bundle-install
+TARGETS = talosctl-cni-bundle
 
 # help menu
 
@@ -116,7 +115,7 @@ docker-%:  ## Builds the specified target defined in the Pkgfile using the docke
 	@$(MAKE) target-$* TARGET_ARGS="$(TARGET_ARGS)"
 
 reproducibility-test:  ## Builds the reproducibility test target
-	@$(MAKE) reproducibility-test-local-reproducibility
+	@$(MAKE) reproducibility-test-local-talosctl-cni-bundle
 
 reproducibility-test-local-%:  ## Builds the specified target defined in the Pkgfile using the local output type with and without cahce. The build result will be output to the specified local destination
 	@rm -rf $(ARTIFACTS)/build-a $(ARTIFACTS)/build-b

Pkgfile

@@ -1,10 +1,10 @@
-# syntax = ghcr.io/siderolabs/bldr:v0.3.2
+# syntax = ghcr.io/siderolabs/bldr:v0.4.0-1-g76a2c8f
 
 format: v1alpha2
 
 vars:
   PKGS_PREFIX: ghcr.io/siderolabs
-  PKGS_VERSION: v1.10.0-alpha.0-32-g38749d1
+  PKGS_VERSION: v1.10.0-alpha.0-35-g85f8901
 
   # renovate: datasource=git-refs versioning=git depName=https://github.com/awslabs/tc-redirect-tap.git
   tc_redirect_tap_ref: fb2c2b5e660adb567157c9d69e1de19b0c7c4f37

base/pkg.yaml

@@ -1,6 +1,5 @@
 name: base
 variant: scratch
-shell: /toolchain/bin/bash
 dependencies:
   - image: "{{ .PKGS_PREFIX }}/base:{{ .PKGS_VERSION }}"
   - image: "{{ .PKGS_PREFIX }}/ca-certificates:{{ .PKGS_VERSION }}"